CVE-2020-13932

Overview

CVE-2020-13932 is a cross-site scripting (XSS) vulnerability in the web console of Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0. The root cause is insufficient sanitization of MQTT packet fields: a specially crafted MQTT packet containing an XSS payload as the client-id or topic name is accepted and later rendered unsafely in the admin console's Diagram Plugin, specifically in queue nodes and the info section [1][2].

Exploitation

The attack is network-based and does not require prior authentication to the message broker. An attacker sends a malicious MQTT packet to a vulnerable Artemis broker. Because the payload is stored in the broker's internal state and later displayed in the browser-based admin console, any administrator viewing the diagram of queues or related info sections will trigger the XSS payload in their session [1][2].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the admin console browser. This could allow an attacker to perform actions on behalf of an authenticated administrator, steal session cookies, deface the console interface, or redirect the admin to malicious sites. The vulnerability is rated Medium severity [2].

Mitigation

The vulnerability is patched in Apache ActiveMQ Artemis version 2.14.0. Users running any affected version (2.5.0 to 2.13.0) should upgrade immediately. There is no workaround mentioned in the advisory; applying the update is the only recommended mitigation [2].