CVE-2022-41678
published 2023-11-28CVE-2022-41678: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows…
PriorityP180high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
85.81%
99.7th percentile
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest can be invoked
through refection. This could lead to RCE through via
various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call copyTo method. The webshell will be written to a .jsp file.
The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.
A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.16.6 | 5.16.6 |
| apache | activemq | >= 0 < 5.16.1-1+deb11u1 | 5.16.1-1+deb11u1 |
| apache | activemq | >= 0 < 5.17.2+dfsg-2+deb12u1 | 5.17.2+dfsg-2+deb12u1 |
| apache | activemq | >= 0 < 5.17.6+dfsg-1 | 5.17.6+dfsg-1 |
| apache | activemq | >= 0 < 5.16.1-1ubuntu0.1 | 5.16.1-1ubuntu0.1 |
| apache | activemq | >= 0 < 5.13.2+dfsg-2ubuntu0.1~esm1 | 5.13.2+dfsg-2ubuntu0.1~esm1 |
| apache | activemq | >= 0 < 5.15.8-2~18.04.1~esm1 | 5.15.8-2~18.04.1~esm1 |
| apache | activemq | >= 0 < 5.15.11-1ubuntu0.1~esm1 | 5.15.11-1ubuntu0.1~esm1 |
| apache | activemq | >= 0 < 5.16.1-1ubuntu0.1~esm1 | 5.16.1-1ubuntu0.1~esm1 |
| apache | activemq | >= 5.17.0 < 5.17.4 | 5.17.4 |
| apache_software_foundation | apache_activemq | < 5.16.6 | 5.16.6 |
| apache_software_foundation | apache_activemq | >= 5.17.0 < 5.17.4 | 5.17.4 |
| debian | activemq | < activemq 5.17.2+dfsg-2+deb12u1 (bookworm) | activemq 5.17.2+dfsg-2+deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect POST requests to /api/jolokia — the exploit uses HttpRequestHandler#handlePostRequest to create JmxRequest via JSONObject for RCE ↗
- →Alert on Jolokia exec-handler invocations targeting jdk.management.jfr.FlightRecorderMXBeanImpl — specifically the sequence: newRecording → setConfiguration (with embedded webshell) → startRecording → copyTo ↗
- →Monitor for the four-step exploit chain: (1) newRecording, (2) setConfiguration with embedded payload, (3) startRecording, (4) copyTo writing a .jsp webshell to disk ↗
- →Use Shodan/FOFA queries to identify exposed ActiveMQ instances as potential targets: shodan 'http.title:"ActiveMQ"', fofa 'title="ActiveMQ"' ↗
- →Detect GET requests to /api/jolokia/list/org.apache.logging.log4j2 with Basic auth header — used by PoC to probe for vulnerable setConfigText/getConfigText operations ↗
- →Response body containing both 'setConfigText' and 'getConfigText' from /api/jolokia indicates a vulnerable ActiveMQ instance ↗
- →CVE-2026-34197 is a bypass for CVE-2022-41678; on ActiveMQ versions 6.0.0–6.1.1, CVE-2024-32114 exposes the Jolokia API without authentication, making this effectively unauthenticated RCE ↗
- →Default credentials admin:admin (Base64: YWRtaW46YWRtaW4=) are commonly used in exploitation; flag any Jolokia authentication using these credentials ↗
- ·Exploitation requires authenticated access to Jolokia; environments with strong authentication and properly restricted or disabled Jolokia are at significantly reduced risk ↗
- ·The FlightRecorderMXBeanImpl deserialization vector only applies to Java 11 and above; Java versions below 11 are not affected by this specific exploitation path ↗
- ·On ActiveMQ 6.0.0–6.1.1, CVE-2024-32114 removes the authentication requirement entirely, elevating this to unauthenticated RCE when chained ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
activemq vulnerabilities
osv·2025-02-14·CVSS 8.8
CVE-2022-41678 [HIGH] activemq vulnerabilities
activemq vulnerabilities
It was discovered that Apache ActiveMQ incorrectly handled
authentication. A remote attacker could possibly use this issue to run
arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled
deserialization. A remote attacker could possibly use this issue to run
arbitrary shell commands. (CVE-2023-46604)
OSV
activemq vulnerabilities
osv·2024-07-23·CVSS 2.7
CVE-2015-7559 [LOW] activemq vulnerabilities
activemq vulnerabilities
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain
commands. A remote attacker could possibly use this issue to terminate
the program, resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS. (CVE-2015-7559)
Peter Stöckli discovered that Apache ActiveMQ incorrectly handled
hostname verification. A remote attacker could possibly use this issue
to perform a person-in-the-middle attack. This issue only affected Ubuntu
16.04 LTS. (CVE-2018-11775)
Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache
ActiveMQ incorrectly handled authentication in certain functions.
A remote attacker could possibly use this issue to perform a
person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS
OSV
CVE-2022-41678: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution
osv·2023-11-28·CVSS 8.8
CVE-2022-41678 [HIGH] CVE-2022-41678: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The
GHSA
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
ghsa·2023-11-28
CVE-2022-41678 [HIGH] CWE-287 Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.
And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call
OSV
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
osv·2023-11-28
CVE-2022-41678 [HIGH] Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.
And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call
CISA ICS
Hitachi Energy Asset Suite
cisa_ics·2025-09-18·CVSS 7.1
[HIGH] Hitachi Energy Asset Suite
ICS Advisory
##
Hitachi Energy Asset Suite
Release DateSeptember 18, 2025
Alert CodeICSA-25-261-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Asset Suite
- Vulnerabilities: Server-Side Request Forgery (SSRF), Deserialization of Untrusted Data, Cleartext Storage of Sensitive Information, Uncontrolled Resource Consumption, URL Redirection to Untrusted Site ('Open Redirect'), Improper Authentication
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow attackers to trigger resource consumption or information disclosure through SSRF in Apache XML Gra
Ubuntu
Apache ActiveMQ vulnerabilities
vendor_ubuntu·2025-02-14·CVSS 8.8
CVE-2023-46604 [HIGH] Apache ActiveMQ vulnerabilities
Title: Apache ActiveMQ vulnerabilities
Summary: Several security issues were fixed in Apache ActiveMQ.
It was discovered that Apache ActiveMQ incorrectly handled
authentication. A remote attacker could possibly use this issue to run
arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled
deserialization. A remote attacker could possibly use this issue to run
arbitrary shell commands. (CVE-2023-46604)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apache ActiveMQ vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 2.7
CVE-2021-26117 [LOW] Apache ActiveMQ vulnerabilities
Title: Apache ActiveMQ vulnerabilities
Summary: Several security issues were fixed in Apache ActiveMQ.
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain
commands. A remote attacker could possibly use this issue to terminate
the program, resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS. (CVE-2015-7559)
Peter Stöckli discovered that Apache ActiveMQ incorrectly handled
hostname verification. A remote attacker could possibly use this issue
to perform a person-in-the-middle attack. This issue only affected Ubuntu
16.04 LTS. (CVE-2018-11775)
Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache
ActiveMQ incorrectly handled authentication in certain functions.
A remote attacker could possibly use this issue to perform a
person-in-
Red Hat
ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
vendor_redhat·2023-11-28·CVSS 8.8
CVE-2022-41678 [HIGH] CWE-502 ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest can be invoked
through refection. This could lead to RCE through via
various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call s
Debian
CVE-2022-41678: activemq - Once an user is authenticated on Jolokia, he can potentially trigger arbitrary c...
vendor_debian·2022·CVSS 8.8
CVE-2022-41678 [HIGH] CVE-2022-41678: activemq - Once an user is authenticated on Jolokia, he can potentially trigger arbitrary c...
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The
No detection rules found.
Nuclei
Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
nuclei·CVSS 8.8
CVE-2022-41678 [HIGH] Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides
Bugzilla
CVE-2022-41678 ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
bugzilla·2023-11-30·CVSS 8.8
CVE-2022-41678 [HIGH] CVE-2022-41678 ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
CVE-2022-41678 ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hi
Hackernews
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
blogs_hackernews·2026-04-09
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Thursday. Another week, another batch of things that probably should've been caught sooner but weren't.
This one's got some range — old vulnerabilities getting new life, a few "why was that even possible" moments, attackers leaning on platforms and tools you'd normally trust without thinking twice. Quiet escalations more than loud zero-days, but the kind that matter more in practice anyway.
Mix of malware, infrastructure exposure, AI-adjacent weirdness, and some supply chain stuff that's... not great. Let's get into it.
A new variant of the
https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txthttps://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4slhttps://security.netapp.com/advisory/ntap-20240216-0004/https://www.openwall.com/lists/oss-security/2023/11/28/1https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txthttps://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4slhttps://lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlhttps://security.netapp.com/advisory/ntap-20240216-0004/https://www.openwall.com/lists/oss-security/2023/11/28/1
2023-11-28
Published