cbcvebase.
CVE-2024-32114
published 2024-05-02

CVE-2024-32114: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It…

PriorityP181high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.92%
93.4th percentile
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

Affected

3 ranges
VendorProductVersion rangeFixed in
apacheactivemq>= 6.0.0 < 6.1.26.1.2
apache_software_foundationapache_activemq6.0.0 – 6.1.1
debianactivemq

Detection & IOCsextracted from sources · hover to see the quote

url/api/jolokia/search/org.apache.activemq:type=Broker,*
path/api/jolokia/
  • Look for suspicious broker connections in ActiveMQ broker logs that use the internal transport protocol VM and the brokerConfig=xbean:http:// query parameter, which indicates chained exploitation with CVE-2026-34197.
  • CVE-2024-32114 enables unauthenticated access to the Jolokia API on ActiveMQ versions 6.0.0 through 6.1.1, making it a prerequisite chain step for unauthenticated RCE via CVE-2026-34197. Audit all deployments for externally accessible Jolokia endpoints.
  • Shodan/FOFA queries can identify exposed ActiveMQ instances: shodan-query 'http.title:"ActiveMQ"' and fofa-query 'title="ActiveMQ"'.
  • If a warning message appears in ActiveMQ broker logs about a configuration problem during connection attempts using the VM transport, the payload from chained exploitation has already been executed.
  • ·The vulnerability only affects Apache ActiveMQ 6.x (specifically 6.0.0 through 6.1.1); the default conf/jetty.xml does not enforce authentication on the /api/ web context. Upgrading to 6.1.2+ or manually adding authentication to conf/jetty.xml mitigates the issue.
  • ·Default credentials (admin:admin) are common in many ActiveMQ environments, which further lowers the bar for exploitation even on versions not affected by CVE-2024-32114.
  • ·Red Hat's packaged versions of activemq-broker (AMQ Broker 7, AMQ Clients, Camel, Fuse, Data Grid, JBoss EAP, etc.) are listed as Not Affected by CVE-2024-32114.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
vendor_debian8.5LOW
vendor_oracle8.5HIGH
vendor_redhat8.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.