Executive brief
Apache ActiveMQ Artemis, a popular message broker used for communication between different software applications, contains a security flaw in how it handles certain internal notification messages. An attacker could exploit this to bypass security policies and send unauthorized messages, potentially disrupting operations or manipulating data flow. This issue affects systems using the OpenWire protocol and has been resolved in version 2.16.0.
Technical details
A vulnerability in the OpenWire protocol head of Apache ActiveMQ Artemis (specifically identified in version 2.15.0) allows for the production of advisory messages without proper access control. The root cause is a failure to apply policy-based access control to these specific message types, which effectively allows an attacker to bypass security restrictions for the entire session. This is a network-reachable vulnerability that requires no authentication or user interaction. An attacker can exploit this to inject unauthorized advisory messages, impacting the integrity of the messaging system. The issue is addressed in version 2.16.0.
Affected products
- Apache ActiveMQ Artemis < 2.16.0
Timeline
- 2021-01-27: disclosed: NVD published date
- 2021-06-16: advisory: GitHub Advisory published
- 2020-10-29: patched: Fix committed to repository
References
- https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E
- https://github.com/apache/activemq-artemis/commit/e5566d52116d81611d914548adc3cbb14d7118d4
- https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210827-0002