High severityNVD Advisory· Published Nov 28, 2023· Updated Nov 3, 2025

Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

CVE-2022-41678

Description

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated users can exploit Jolokia in Apache ActiveMQ to achieve remote code execution via deserialization in FlightRecorderMXBeanImpl on Java 11+.

The vulnerability resides in the Jolokia HTTP agent servlet, which handles JMX requests. An authenticated attacker can craft a JSON request that reaches the ExecHandler, which uses reflection to invoke MBean methods. By targeting the FlightRecorderMXBeanImpl (available on Java 11+), the attacker can trigger unrestricted deserialization, leading to arbitrary code execution [1][3].

Exploitation involves a sequence of JMX operations: 1. Call newRecording to create a flight recording. 2. Call setConfiguration with a payload that embeds a webshell. 3. Call startRecording. 4. Call copyTo to write the webshell to a .jsp file on the server. All steps require prior authentication to Jolokia [1].

Successful exploitation grants the attacker remote code execution as the ActiveMQ process user. They can write arbitrary files, such as a JSP webshell, to gain persistent access to the server [3].

Mitigation involves restricting Jolokia's allowed actions or disabling it entirely in the ActiveMQ configuration. The default Jolokia configuration has been tightened in ActiveMQ versions 5.16.6, 5.17.4, 5.18.0, and 6.0.0. Users should upgrade to these releases [2].

References

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.activemq:apache-activemqMaven	< 5.16.6	5.16.6
org.apache.activemq:apache-activemqMaven	>= 5.17.0, < 5.17.4	5.17.4

Affected products

osv-coords2 versions
pkg:bitnami/activemq pkg:maven/org.apache.activemq/apache-activemq
< 5.16.6+ 1 more
- (no CPE)range: < 5.16.6
- (no CPE)range: < 5.16.6
Apache Software Foundation/Apache ActiveMQv5
Range: 0

Patches

d8ce1d9ff

Merge pull request #958 from cshannon/AMQ-9201

https://github.com/apache/activemqChristopher L. ShannonFeb 1, 2023via ghsa

commit

1 file changed · +33 −1

assembly/src/release/conf/jolokia-access.xml+33 −1 modified

@@ -22,8 +22,35 @@
     <strict-checking/>
   </cors>
 
-  <!-- deny calling operations or getting attributes from these mbeans -->
+  <!-- By default don't allow write or exec operations -->
+  <commands>
+    <command>read</command>
+    <command>list</command>
+    <command>version</command>
+    <command>search</command>
+  </commands>
+
+  <allow>
+    <!-- Allow all operations for the broker itself -->
+    <mbean>
+      <name>org.apache.activemq:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <!-- Allow all operations for Jolokia Config -->
+    <mbean>
+      <name>jolokia:type=Config</name>
+      <operation>*</operation>
+    </mbean>
+  </allow>
+
+  <!-- deny all operations or getting attributes from these mbeans -->
   <deny>
+    <mbean>
+      <name>org.apache.logging.log4j2:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
     <mbean>
       <name>com.sun.management:type=DiagnosticCommand</name>
       <attribute>*</attribute>
@@ -34,6 +61,11 @@
       <attribute>*</attribute>
       <operation>*</operation>
     </mbean>
+    <mbean>
+      <name>jdk.management.jfr:type=FlightRecorder</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
   </deny>
 
 </restrict>

bf65929fd

AMQ-9201 - Update Jolokia default access configuration

https://github.com/apache/activemqChristopher L. Shannon (cshannon)Feb 1, 2023via ghsa

commit

1 file changed · +33 −1

assembly/src/release/conf/jolokia-access.xml+33 −1 modified

@@ -22,8 +22,35 @@
     <strict-checking/>
   </cors>
 
-  <!-- deny calling operations or getting attributes from these mbeans -->
+  <!-- By default don't allow write or exec operations -->
+  <commands>
+    <command>read</command>
+    <command>list</command>
+    <command>version</command>
+    <command>search</command>
+  </commands>
+
+  <allow>
+    <!-- Allow all operations for the broker itself -->
+    <mbean>
+      <name>org.apache.activemq:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <!-- Allow all operations for Jolokia Config -->
+    <mbean>
+      <name>jolokia:type=Config</name>
+      <operation>*</operation>
+    </mbean>
+  </allow>
+
+  <!-- deny all operations or getting attributes from these mbeans -->
   <deny>
+    <mbean>
+      <name>org.apache.logging.log4j2:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
     <mbean>
       <name>com.sun.management:type=DiagnosticCommand</name>
       <attribute>*</attribute>
@@ -34,6 +61,11 @@
       <attribute>*</attribute>
       <operation>*</operation>
     </mbean>
+    <mbean>
+      <name>jdk.management.jfr:type=FlightRecorder</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
   </deny>
 
 </restrict>

5c8d457d9

AMQ-9201 - Update Jolokia default access configuration

https://github.com/apache/activemqChristopher L. Shannon (cshannon)Feb 1, 2023via ghsa

commit

1 file changed · +33 −1

assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml+33 −1 modified

@@ -22,8 +22,35 @@
     <strict-checking/>
   </cors>
 
-  <!-- deny calling operations or getting attributes from these mbeans -->
+  <!-- By default don't allow write or exec operations -->
+  <commands>
+    <command>read</command>
+    <command>list</command>
+    <command>version</command>
+    <command>search</command>
+  </commands>
+
+  <allow>
+    <!-- Allow all operations for the broker itself -->
+    <mbean>
+      <name>org.apache.activemq:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <!-- Allow all operations for Jolokia Config -->
+    <mbean>
+      <name>jolokia:type=Config</name>
+      <operation>*</operation>
+    </mbean>
+  </allow>
+
+  <!-- deny all operations or getting attributes from these mbeans -->
   <deny>
+    <mbean>
+      <name>org.apache.logging.log4j2:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
     <mbean>
       <name>com.sun.management:type=DiagnosticCommand</name>
       <attribute>*</attribute>
@@ -34,6 +61,11 @@
       <attribute>*</attribute>
       <operation>*</operation>
     </mbean>
+    <mbean>
+      <name>jdk.management.jfr:type=FlightRecorder</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
   </deny>
 
 </restrict>

6120169e563b

AMQ-9201 - Update Jolokia default access configuration

https://github.com/apache/activemqChristopher L. Shannon (cshannon)Feb 1, 2023via ghsa

commit

1 file changed · +33 −1

assembly/src/release/conf/jolokia-access.xml+33 −1 modified

@@ -22,8 +22,35 @@
     <strict-checking/>
   </cors>
 
-  <!-- deny calling operations or getting attributes from these mbeans -->
+  <!-- By default don't allow write or exec operations -->
+  <commands>
+    <command>read</command>
+    <command>list</command>
+    <command>version</command>
+    <command>search</command>
+  </commands>
+
+  <allow>
+    <!-- Allow all operations for the broker itself -->
+    <mbean>
+      <name>org.apache.activemq:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <!-- Allow all operations for Jolokia Config -->
+    <mbean>
+      <name>jolokia:type=Config</name>
+      <operation>*</operation>
+    </mbean>
+  </allow>
+
+  <!-- deny all operations or getting attributes from these mbeans -->
   <deny>
+    <mbean>
+      <name>org.apache.logging.log4j2:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
     <mbean>
       <name>com.sun.management:type=DiagnosticCommand</name>
       <attribute>*</attribute>
@@ -34,6 +61,11 @@
       <attribute>*</attribute>
       <operation>*</operation>
     </mbean>
+    <mbean>
+      <name>jdk.management.jfr:type=FlightRecorder</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
   </deny>
 
 </restrict>

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txtghsavendor-advisoryWEB
github.com/advisories/GHSA-53v4-42fg-g287ghsaADVISORY
lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4slghsavendor-advisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-41678ghsaADVISORY
www.openwall.com/lists/oss-security/2023/11/28/1ghsaWEB
github.com/apache/activemq/commit/5c8d457d9ghsaWEB
github.com/apache/activemq/commit/6120169e563b55323352431dfe9ac67a8b4de6c2ghsaWEB
github.com/apache/activemq/commit/bf65929fdghsaWEB
github.com/apache/activemq/commit/d8ce1d9ffghsaWEB
github.com/apache/activemq/pull/958ghsaWEB
lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlghsaWEB
security.netapp.com/advisory/ntap-20240216-0004ghsaWEB
www.openwall.com/lists/oss-security/2023/11/28/1ghsaWEB
security.netapp.com/advisory/ntap-20240216-0004/mitre

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.075
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000