ActivemqApplication · Apache
CVE-2022-41678
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedOnce an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAuthenticated users on Jolokia-equipped ActiveMQ can achieve RCE by calling ExecHandler to trigger JDK FlightRecorderMXBeanImpl methods. The attack chain creates a recording, embeds webshell payload in setConfiguration, starts the recording, then uses copyTo to write a .jsp file to disk.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
ActivemqApplication
< 5.16.6>= 5.17.0, < 5.17.4CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify ActiveMQ versionCheck the version file in the ActiveMQ installation - typically found in RELEASE_NOTES, wrapper.conf, or the broker JAR's manifest. Run: grep -r '5\.' $ACTIVEMQ_HOME/lib/activemq-broker-*.jar 2>/dev/null || find $ACTIVEMQ_HOME -name 'version.txt' -o -name 'RELEASE_NOTES' | xargs grep -i versionAffected if The installed version falls outside the safe ranges: it is below 5.16.6, or between 5.17.0 and 5.17.4 inclusive. Versions 5.16.6+, 5.17.4+, 5.18.0+, and 6.0.0+ are not affected.
-
Confirm Jolokia endpoint is exposedCheck if the Jolokia HTTP endpoint is accessible on the default web console port. Run: curl -s -o /dev/null -w '%{http_code}' http://localhost:8161/api/jolokia/ 2>/dev/null or test manually using a browser. Also verify the jetty.xml or jetty-realm.properties contains a Jolokia servlet mapping.Affected if The Jolokia endpoint returns an HTTP 200 response, indicating that Jolokia is enabled and reachable over the network.
-
Inspect Jolokia security configurationLocate the Jolokia configuration in the ActiveMQ conf directory - typically in jetty.xml or a dedicated jolokia-access.xml. Check for the 'policy' or 'security' section. Look for attributes such as 'readonly=true', 'allowedActions', or 'denyList' that restrict ExecHandler and FlightRecorderMXBean access.Affected if No restrictive policy is configured, or the configuration allows 'exec' and 'write' actions on MBeans, enabling the attack chain to create recordings and write files.
-
Verify web console authenticationConfirm whether the Jolokia endpoint (and entire web console) is protected by authentication. Check conf/jetty.xml for constraint mappings and conf/jetty-users.properties or conf/credentials.properties for defined users. Test by attempting unauthenticated access to /api/jolokia/Affected if The Jolokia endpoint is accessible without authentication, or weak/default credentials are in use, allowing an attacker to invoke the malicious MBean methods.
You are affected if your ActiveMQ version is below 5.16.6 or between 5.17.0 and 5.17.4, Jolokia is exposed on the network, and no restrictive Jolokia security policy is configured to block exec and write operations.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.16.65.17.4
Apply restrictive Jolokia configuration (limiting allowed actions) or disable Jolokia entirely. Upgrade to ActiveMQ 5.16.6+, 5.17.4+, 5.18.0+, or 6.0.0 which include hardened Jolokia settings by default.
5.16.6, 5.17.4, 5.18.0, or 6.0.0 (or later)
- Download Apache ActiveMQ version 5.16.6, 5.17.4, 5.18.0, or 6.0.0 (or later) from the official Apache ActiveMQ distribution
- Stop the currently running ActiveMQ instance
- Back up your existing ActiveMQ configuration and data directories
- Extract the new ActiveMQ distribution to your desired installation path
- Migrate any custom configurations from the old installation to the new one (if applicable)
- Start the upgraded ActiveMQ instance
- Verify the Jolokia endpoint is accessible and the new restrictive configuration is in effect
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Activemq
Scoped from the published advisory
- Consultation3.0 h
- Implementation6.0 h
- Testing5.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,752.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-41678 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-41678 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data