Bug 2278791 (CVE-2024-32114)

Summary:	CVE-2024-32114 activemq-broker: Jolokia and REST API were not secured with default configuration
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asoldano, ataylor, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, chfoley, cmiranda, darran.lofthouse, dkreling, dosoudil, fjuma, fmariani, gmalinko, istudens, ivassile, iweiss, janstey, jpoth, jross, jscholz, kaycoth, lgao, mosmerov, msochure, mstefank, msvehla, nwallace, pcongius, pdelbell, pjindal, pmackay, rkieley, rstancel, rstepani, smaestri, swoodman, tcunning, tom.jenkinson, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ActiveMQ 6.1.2, ActiveMQ 6.2.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Apache ActiveMQ. This vulnerability contains an insecure default configuration in Jolokia and REST API, allowing any user to bypass security restrictions. The vulnerability exists due to missing authorization in the application's REST API. The default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. This flaw allows an unauthenticated attacker to interact with the broker using the Jolokia JMX REST API to produce/consume messages or purge/delete destinations using the Message REST API.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2278796

Description TEJ RATHI 2024-05-03 05:37:49 UTC

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
https://issues.apache.org/jira/browse/AMQ-9477