CVE-2024-32114

Published May 2, 2024

Last updated a year ago

CVSS high 8.5

Apache ActiveMQ

Jolokia JMX REST API

Message REST API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-32114 is an authentication bypass vulnerability found in Apache ActiveMQ 6.x, stemming from an insecure default configuration. This flaw exposes critical API endpoints, specifically the Jolokia JMX REST API and the Message REST API, without requiring any authentication. As a result, unauthenticated users can gain access to these interfaces. This lack of authentication allows unauthorized individuals to interact with the message broker. This interaction can involve producing or consuming messages, modifying broker configurations, and purging or deleting message destinations. The vulnerability affects Apache ActiveMQ versions 6.0.0 through 6.1.1, with the issue being addressed in version 6.1.2 where the default configuration was updated to include authentication.

Description: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Source: security@apache.org
NVD status: Analyzed
Products: activemq

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-1188

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6FB85E4D-E8E7-4F62-ABE8-05014AB4481B",
            "versionEndExcluding": "6.1.2",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.