CVE-2024-32114
📋 TL;DR
Apache ActiveMQ 6.x has a default configuration vulnerability that leaves the API web context unsecured, allowing unauthenticated access to Jolokia JMX REST API and Message REST API. This affects all users running ActiveMQ 6.x with default settings, enabling unauthorized interaction with the broker and message operations.
💻 Affected Systems
- Apache ActiveMQ
📦 What is this software?
Activemq by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete broker compromise allowing unauthorized message production/consumption, destination deletion, and potential remote code execution via JMX operations.
Likely Case
Unauthorized message manipulation, data exfiltration, and broker disruption through message queue operations.
If Mitigated
No impact if proper authentication is configured or systems are upgraded to patched versions.
🎯 Exploit Status
Exploitation requires no authentication and uses standard REST API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.2
Vendor Advisory: https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
Restart Required: Yes
Instructions:
1. Upgrade to ActiveMQ 6.1.2 or later. 2. Restart the ActiveMQ service. 3. Verify authentication is enabled on API endpoints.
🔧 Temporary Workarounds
Manual Configuration Update
allAdd authentication requirement to conf/jetty.xml configuration file
Edit conf/jetty.xml and add: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean>
🧯 If You Can't Patch
- Implement network segmentation to restrict access to ActiveMQ API ports (typically 8161)
- Deploy a reverse proxy with authentication in front of ActiveMQ web interface
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://activemq-host:8161/api/jolokia or http://activemq-host:8161/api/message without authentication. If accessible, system is vulnerable.Check Version:
Check ActiveMQ web console or run: java -jar activemq.jar --versionVerify Fix Applied:
Verify authentication is required when accessing API endpoints. Check ActiveMQ version is 6.1.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated API access attempts
- JMX operations from unauthorized IPs
- Message operations without user authentication
Network Indicators:
- HTTP requests to /api/jolokia or /api/message without authentication headers
- Unusual message queue activity
SIEM Query:
source="activemq" AND (uri_path="/api/jolokia" OR uri_path="/api/message") AND NOT auth_user=*