CVE-2022-41678

Published Nov 28, 2023

Last updated 2 years ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2022-41678 is a vulnerability affecting Apache ActiveMQ, specifically through its Jolokia API. This flaw allows an authenticated user to potentially trigger arbitrary code execution. The vulnerability stems from the management of requests via the Jolokia API, which enables the exploitation of various MBeans through Java Management Extensions (JMX) requests. The attack vector involves interactions with the Jetty server, where an authenticated user can leverage exposed Log4J MBeans or Java Flight Recorder (JFR) interfaces. This can lead to capabilities such as arbitrary file writing, which in turn facilitates the injection of malicious code onto the server's filesystem, ultimately resulting in remote code execution. Affected versions include Apache ActiveMQ versions prior to 5.16.6, 5.17.4, and 5.18.0.

Description: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-287

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 7

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2CD766F1-F0C9-4CFE-85F5-308248C6E44C",
            "versionEndExcluding": "5.16.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B0D4F2D0-6707-47EA-BE24-D1B273EF5122",
            "versionEndExcluding": "5.17.4",
            "versionStartIncluding": "5.17.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.