Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- artemis-core-client
Version range not reported
- eap7-activemq-artemis
Version range not reported
- eap7-glassfish-jsf
Version range not reported
- eap7-ironjacamar
Version range not reported
- eap7-jackson-annotations
Version range not reported
- eap7-jackson-core
Version range not reported
- eap7-jackson-databind
Version range not reported
- eap7-jackson-jaxrs-providers
Version range not reported
- eap7-jackson-modules-base
Version range not reported
- eap7-jackson-modules-java8
Version range not reported
- eap7-jboss-remoting
Version range not reported
- eap7-jboss-server-migration
Version range not reported
- eap7-netty
Version range not reported
- eap7-netty-transport-native-epoll
Version range not reported
- eap7-picketlink-bindings
Version range not reported
- eap7-picketlink-federation
Version range not reported
- eap7-undertow
Version range not reported
- eap7-wildfly
Version range not reported
- artemis-core-client
Version range not reported