Executive brief
Apache ActiveMQ Artemis, a high-performance message broker, contains a security flaw where user passwords may be stored in plain text on the server's disk. This occurs when an administrator uses the 'resetUsers' management command. A local attacker with access to the server's file system could read these credentials, potentially leading to unauthorized access to the messaging system and sensitive data.
Technical details
A vulnerability exists in the Apache ActiveMQ Artemis management API (versions 2.7.0 through 2.12.0) due to improper handling of credentials during the 'resetUsers' operation. When this specific operation is invoked, the application inadvertently writes passwords in cleartext to the 'etc/artemis-users.properties' shadow file instead of using secure hashing. A local attacker with low privileges who can read the file system can retrieve these plaintext passwords. This issue is classified under CWE-312 (Cleartext Storage of Sensitive Information). A fix is available in version 2.13.0, and a suggested mitigation is to use the broker instance CLI ('artemis user reset') which is not affected.
Affected products
- Apache ActiveMQ Artemis 2.7.0 - 2.12.0
Timeline
- 2020-04-23: disclosed: Initial report to Red Hat Bugzilla
- 2020-06-25: patched: Red Hat AMQ errata released
- 2020-06-26: advisory: NVD published CVE-2020-10727
- 2022-05-24: advisory: GitHub Advisory published