Remote Code Execution in JMeter by Apache

CVE-2019-0187

What is CVE-2019-0187?

This vulnerability allows attackers to perform unauthorized Remote Code Execution (RCE) when Apache JMeter is operated in distributed mode using the -r or -R command line options. An attacker can exploit this flaw by establishing a Remote Method Invocation (RMI) connection to a jmeter-server and utilizing untrusted data deserialization, posing significant risks during testing. Versions prior to 4.0 are particularly vulnerable as they lack encryption for traffic between nodes and do not authenticate participating nodes. Upgrading to JMeter 5.1 or later is strongly recommended to mitigate this risk.

References