Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

• https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
• https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
• https://security.netapp.com/advisory/ntap-20240216-0004/
• https://www.openwall.com/lists/oss-security/2023/11/28/1
• https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
• https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
• https://security.netapp.com/advisory/ntap-20240216-0004/
• https://www.openwall.com/lists/oss-security/2023/11/28/1

• Apache » Activemq » Version: N/A
  cpe:2.3:a:apache:activemq:-
• Apache » Activemq » Version: 4.0
  cpe:2.3:a:apache:activemq:4.0
• Apache » Activemq » Version: 4.0.1
  cpe:2.3:a:apache:activemq:4.0.1
• Apache » Activemq » Version: 4.0.2
  cpe:2.3:a:apache:activemq:4.0.2
• Apache » Activemq » Version: 4.1.0
  cpe:2.3:a:apache:activemq:4.1.0
• Apache » Activemq » Version: 4.1.1
  cpe:2.3:a:apache:activemq:4.1.1
• Apache » Activemq » Version: 4.1.2
  cpe:2.3:a:apache:activemq:4.1.2
• Apache » Activemq » Version: 5.0.0
  cpe:2.3:a:apache:activemq:5.0.0
• Apache » Activemq » Version: 5.1.0
  cpe:2.3:a:apache:activemq:5.1.0
• Apache » Activemq » Version: 5.10.0
  cpe:2.3:a:apache:activemq:5.10.0
• Apache » Activemq » Version: 5.10.1
  cpe:2.3:a:apache:activemq:5.10.1
• Apache » Activemq » Version: 5.10.2
  cpe:2.3:a:apache:activemq:5.10.2
• Apache » Activemq » Version: 5.11.0
  cpe:2.3:a:apache:activemq:5.11.0
• Apache » Activemq » Version: 5.11.1
  cpe:2.3:a:apache:activemq:5.11.1
• Apache » Activemq » Version: 5.11.2
  cpe:2.3:a:apache:activemq:5.11.2
• Apache » Activemq » Version: 5.11.3
  cpe:2.3:a:apache:activemq:5.11.3
• Apache » Activemq » Version: 5.12.0
  cpe:2.3:a:apache:activemq:5.12.0
• Apache » Activemq » Version: 5.12.1
  cpe:2.3:a:apache:activemq:5.12.1
• Apache » Activemq » Version: 5.12.2
  cpe:2.3:a:apache:activemq:5.12.2
• Apache » Activemq » Version: 5.12.3
  cpe:2.3:a:apache:activemq:5.12.3
• Apache » Activemq » Version: 5.13.0
  cpe:2.3:a:apache:activemq:5.13.0
• Apache » Activemq » Version: 5.13.1
  cpe:2.3:a:apache:activemq:5.13.1
• Apache » Activemq » Version: 5.13.2
  cpe:2.3:a:apache:activemq:5.13.2
• Apache » Activemq » Version: 5.13.3
  cpe:2.3:a:apache:activemq:5.13.3
• Apache » Activemq » Version: 5.13.4
  cpe:2.3:a:apache:activemq:5.13.4
• Apache » Activemq » Version: 5.13.5
  cpe:2.3:a:apache:activemq:5.13.5
• Apache » Activemq » Version: 5.14.0
  cpe:2.3:a:apache:activemq:5.14.0
• Apache » Activemq » Version: 5.14.1
  cpe:2.3:a:apache:activemq:5.14.1
• Apache » Activemq » Version: 5.14.2
  cpe:2.3:a:apache:activemq:5.14.2
• Apache » Activemq » Version: 5.14.3
  cpe:2.3:a:apache:activemq:5.14.3
• Apache » Activemq » Version: 5.14.4
  cpe:2.3:a:apache:activemq:5.14.4
• Apache » Activemq » Version: 5.14.5
  cpe:2.3:a:apache:activemq:5.14.5
• Apache » Activemq » Version: 5.15.0
  cpe:2.3:a:apache:activemq:5.15.0
• Apache » Activemq » Version: 5.15.1
  cpe:2.3:a:apache:activemq:5.15.1
• Apache » Activemq » Version: 5.15.10
  cpe:2.3:a:apache:activemq:5.15.10
• Apache » Activemq » Version: 5.15.11
  cpe:2.3:a:apache:activemq:5.15.11
• Apache » Activemq » Version: 5.15.12
  cpe:2.3:a:apache:activemq:5.15.12
• Apache » Activemq » Version: 5.15.13
  cpe:2.3:a:apache:activemq:5.15.13
• Apache » Activemq » Version: 5.15.14
  cpe:2.3:a:apache:activemq:5.15.14
• Apache » Activemq » Version: 5.15.15
  cpe:2.3:a:apache:activemq:5.15.15
• Apache » Activemq » Version: 5.15.16
  cpe:2.3:a:apache:activemq:5.15.16
• Apache » Activemq » Version: 5.15.2
  cpe:2.3:a:apache:activemq:5.15.2
• Apache » Activemq » Version: 5.15.3
  cpe:2.3:a:apache:activemq:5.15.3
• Apache » Activemq » Version: 5.15.4
  cpe:2.3:a:apache:activemq:5.15.4
• Apache » Activemq » Version: 5.15.5
  cpe:2.3:a:apache:activemq:5.15.5
• Apache » Activemq » Version: 5.15.6
  cpe:2.3:a:apache:activemq:5.15.6
• Apache » Activemq » Version: 5.15.7
  cpe:2.3:a:apache:activemq:5.15.7
• Apache » Activemq » Version: 5.15.8
  cpe:2.3:a:apache:activemq:5.15.8
• Apache » Activemq » Version: 5.15.9
  cpe:2.3:a:apache:activemq:5.15.9
• Apache » Activemq » Version: 5.16.0
  cpe:2.3:a:apache:activemq:5.16.0
• Apache » Activemq » Version: 5.16.1
  cpe:2.3:a:apache:activemq:5.16.1
• Apache » Activemq » Version: 5.16.2
  cpe:2.3:a:apache:activemq:5.16.2
• Apache » Activemq » Version: 5.17.0
  cpe:2.3:a:apache:activemq:5.17.0
• Apache » Activemq » Version: 5.2.0
  cpe:2.3:a:apache:activemq:5.2.0
• Apache » Activemq » Version: 5.3.0
  cpe:2.3:a:apache:activemq:5.3.0
• Apache » Activemq » Version: 5.3.1
  cpe:2.3:a:apache:activemq:5.3.1
• Apache » Activemq » Version: 5.3.2
  cpe:2.3:a:apache:activemq:5.3.2
• Apache » Activemq » Version: 5.4.0
  cpe:2.3:a:apache:activemq:5.4.0
• Apache » Activemq » Version: 5.4.1
  cpe:2.3:a:apache:activemq:5.4.1
• Apache » Activemq » Version: 5.4.2
  cpe:2.3:a:apache:activemq:5.4.2
• Apache » Activemq » Version: 5.4.3
  cpe:2.3:a:apache:activemq:5.4.3
• Apache » Activemq » Version: 5.5.0
  cpe:2.3:a:apache:activemq:5.5.0
• Apache » Activemq » Version: 5.5.1
  cpe:2.3:a:apache:activemq:5.5.1
• Apache » Activemq » Version: 5.6.0
  cpe:2.3:a:apache:activemq:5.6.0
• Apache » Activemq » Version: 5.7.0
  cpe:2.3:a:apache:activemq:5.7.0
• Apache » Activemq » Version: 5.8.0
  cpe:2.3:a:apache:activemq:5.8.0
• Apache » Activemq » Version: 5.9.0
  cpe:2.3:a:apache:activemq:5.9.0
• Apache » Activemq » Version: 5.9.1
  cpe:2.3:a:apache:activemq:5.9.1