Default Configuration Flaw Exposes ActiveMQ Broker to Unauthorized Access

CVE-2024-32114

Summary

In Apache ActiveMQ versions prior to 6.1.2, the default security configuration fails to secure key API endpoints, specifically the Jolokia JMX REST API and the Message REST API. This lack of authentication enables unauthorized users to access sensitive functionalities, allowing potential manipulation of the broker's operations, including message production, consumption, and destination deletion. To prevent unauthorized access, it is crucial to update the conf/jetty.xml configuration file to enforce authentication or upgrade to version 6.1.2 where security measures are implemented by default.

References