Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control

highseverity

8.8CVSS score

7.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.

Impact

Unauthenticated users can interact with the broker, potentially producing, consuming, or deleting messages and accessing sensitive management APIs.

Fix

Upgrade to Apache ActiveMQ 6.1.2 or later, or update `conf/jetty.xml` to require authentication on the `/api/` web context.

How to confirm it

Send: GET {{BaseURL}}/api/jolokia/search/org.apache.activemq:type=Broker,*
Positive when: contains_all(body, "request\":{", "type=Broker", "mbean\":", "org.apache.activemq") and contains(content_type, "text/plain") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-32114 -u <target>

The full check

id: CVE-2024-32114

info:
  name: Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
  author: ChrisJr404
  severity: high
  description: |
    Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.
  impact: |
    Unauthenticated users can interact with the broker, potentially producing, consuming, or deleting messages and accessing sensitive management APIs.
  remediation: |
    Upgrade to Apache ActiveMQ 6.1.2 or later, or update `conf/jetty.xml` to require authentication on the `/api/` web context.
  reference:
    - https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
    - https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2024-32114
    - https://github.com/advisories/GHSA-gj5m-m88j-v7c3
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32114
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2024-32114
    cwe-id: CWE-1188
    epss-score: 0.07148
    epss-percentile: 0.94324
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: activemq
    shodan-query: http.title:"ActiveMQ"
    fofa-query: title="ActiveMQ"
  tags: cve,cve2024,activemq,apache,jolokia,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/jolokia/search/org.apache.activemq:type=Broker,*"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "request\":{", "type=Broker", "mbean\":", "org.apache.activemq")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from