Executive brief
Jolokia is a JMX (Java Management eXtensions) proxy that allows remote monitoring and management of Java applications. A flaw in its JSR-160 proxy mode allows attackers to bypass security controls by crafting malicious JMX service URLs, potentially enabling them to execute code on the server, steal credentials, or cause service disruption.
Technical details
The vulnerability is an incomplete fix for CVE-2018-1000130, stemming from inadequate validation of JMX service URLs in the JSR-160 proxy. The proxy accepts a `target.url` parameter from POST requests and passes it to `JMXServiceURL` and `JMXConnectorFactory` without proper validation. The denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, but attackers can bypass this using alternative JMX URL forms such as `ldaps://` schemes or LDAP URLs with non-empty JMX host components. These bypasses trigger JNDI lookups against attacker-controlled LDAP endpoints, enabling SSRF, credential forwarding, and potentially remote code execution depending on available classes in the target JVM. The vulnerability requires network access to the Jolokia proxy but no authentication or user interaction.
Affected products
- Jolokia Jolokia before 2.6.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in Jolokia 2.6.2