CVE-2020-10727

Vulnerability

Overview

A flaw exists in the ActiveMQ Artemis management API from version 2.7.0 up to 2.12.0, where executing the resetUsers operation inadvertently stores the new password in plaintext in the Artemis shadow file (etc/artemis-users.properties). This occurs because the operation fails to hash or encrypt the password before writing it to disk [1][2].

Attack

Vector

To exploit this vulnerability, an attacker must have local access to the system running ActiveMQ Artemis. No authentication is required beyond being able to read the file system where the broker's configuration resides. The attacker can simply read the contents of the etc/artemis-users.properties file to retrieve plaintext passwords of all users that were reset using the management API [1][2].

Potential

Impact

A local attacker can leverage the exposed plaintext passwords to gain unauthorized access to the messaging broker, potentially intercepting, modifying, or disrupting message flows. This could lead to further compromise of connected systems and data exposure [1][2].

Mitigation

Status

The issue has been addressed in Red Hat AMQ via RHSA-2020:2751 [2]. Users are advised to upgrade to a fixed version (2.12.0 or later). As a workaround, administrators can use the broker instance CLI command /bin/artemis user reset, which is not affected by this flaw [2].