CVE-2023-50780: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ Artemis

By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/console/jolokia the following attack vectors have been identified:

• Arbitrary File Write using Log4J indirectly resulting in Remote Code Execution
• Arbitrary File Read using Log4J
• DoS using Artemis Broker MBeans

This vulnerability can be exploited by a local attacker that knows the basic authentication credentials used by the Artemis web interface.

Note: If the server is set with "--allow-anonymous", then any non-null user-password combination can be used to authenticate.

Vendor Disclosure:

The vendor's disclosure for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Valid credentials for user with "admin" role (if authentication is required)

Proof Of Concept:

As multiple attack vectors have been identified, you can find more details and the exploitation processes of interest in one or more of the following PDFs:

• The initial report that was sent to the vendor: . The RCE vector requires: