{"id":"CVE-2022-41678","published":"2023-11-28T15:08:38Z","modified":"2025-11-03T21:46:33Z","title":"Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE","vendor":"Apache Software Foundation","product":"Apache ActiveMQ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","versions":["< 5.16.6",">= 5.17.0, < 5.17.4"]}],"description":{"text":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. \n\nIn details, in ActiveMQ configurations, jetty allows\norg.jolokia.http.AgentServlet to handler request to /api/jolokia\n\norg.jolokia.http.HttpRequestHandler#handlePostRequest is able to\ncreate JmxRequest through JSONObject. And calls to\norg.jolokia.http.HttpRequestHandler#executeRequest.\n\nInto deeper calling stacks,\norg.jolokia.handler.ExecHandler#doHandleRequest can be invoked\nthrough refection. This could lead to RCE through via\nvarious mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.\n\n1 Call newRecording.\n\n2 Call setConfiguration. And a webshell data hides in it.\n\n3 Call startRecording.\n\n4 Call copyTo method. The webshell will be written to a .jsp file.\n\nThe mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.\nA more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache ActiveMQ's Jolokia management API (exposed at /api/jolokia) fails to restrict the operations authenticated users can invoke, allowing exploitation through the exec handler and its MBeans. An attacker who holds valid credentials for the Jolokia endpoint can achieve remote code execution, including by abusing an unrestricted deserialization path in the Flight Recorder MBean on Java versions above 11 to write a webshell to disk.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:19Z"},"cvss":null,"epss":{"score":0.8581,"percentile":0.99727,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl","tags":["vendor-advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/11/28/1","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240216-0004/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:apache-activemq","vulnerableRanges":["<5.16.6",">=5.17.0, <5.17.4"],"patched":["5.16.6","5.17.4"],"from":["GHSA-53v4-42fg-g287"],"provenance":"source"}],"advisories":[{"id":"GHSA-53v4-42fg-g287","url":"https://github.com/advisories/GHSA-53v4-42fg-g287","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:apache-activemq","vulnerableRanges":["<5.16.6"],"patched":["5.16.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-53v4-42fg-g287","url":"https://github.com/advisories/GHSA-53v4-42fg-g287","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:apache-activemq","vulnerableRanges":[">=5.17.0, <5.17.4"],"patched":["5.17.4"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2884","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2884","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2024-11-28","earliestUrl":"https://github.com/mbadanoiu/CVE-2022-41678","repos":[{"name":"Catherines77/ActiveMQ-EXPtools","url":"https://github.com/Catherines77/ActiveMQ-EXPtools","stars":86,"created":"2026-04-20"},{"name":"mbadanoiu/CVE-2022-41678","url":"https://github.com/mbadanoiu/CVE-2022-41678","stars":2,"created":"2024-11-28"},{"name":"URJACK2025/CVE-2022-41678","url":"https://github.com/URJACK2025/CVE-2022-41678","stars":2,"created":"2025-10-14"}]},"nuclei":[{"id":"CVE-2022-41678","name":"Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution","severity":"high","path":"http/cves/2022/CVE-2022-41678.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41678.yaml"}],"first":{"date":"2024-11-28","source":"PoC-in-GitHub","url":"https://github.com/mbadanoiu/CVE-2022-41678"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-11-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-41678","provenance":"source"},{"date":"2024-11-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mbadanoiu/CVE-2022-41678","provenance":"source"}],"speed":{"daysToPublicExploit":366,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}