Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2020-11998 BIT-activemq-2020-11998EUVD-2022-1236GHSA-wqfh-9m4g-7x6x

Remote code execution in Apache ActiveMQ

Published Sep 10, 2020 · Updated Aug 4, 2024 · Assigned by apache

Package: activemq Package: org.apache.activemq:activemq-parent Ecosystem: Maven Ecosystem: Ubuntu

Description

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Affected products

VendorProductAffectedFixed
— Apache ActiveMQ Apache Tomcat 5.15.12 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 activemq No fix yet —
Ubuntu 26.04 LTS activemq No fix yet —
Ubuntu 25.10 activemq No fix yet —
Ubuntu 24.04 LTS activemq No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS activemq No fix yet —
Ubuntu Pro 20.04 LTS activemq No fix yet —
Ubuntu Pro 18.04 LTS activemq No fix yet —
Ubuntu Pro 16.04 LTS activemq No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.activemq:activemq-parent >= 5.15.12, < 5.15.13 5.15.13 GHSA-wqfh-9m4g-7x6x

References