Add ActiveMQ Jolokia RCE Detection Module (CVE-2026-34197) (Fixes #1507) #1531
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,187 @@ | ||
| info: | ||
| name: activemq_cve_2026_34197_jolokia_rce_vuln | ||
| author: Nettacker Team | ||
| severity: 8.8 | ||
| description: | | ||
| Detects CVE-2026-34197 in Apache ActiveMQ Classic via Jolokia API. | ||
| The vulnerability allows execution of addNetworkConnector which can | ||
| load remote configuration via vm:// and xbean: protocol. | ||
| Detection is performed by invoking addNetworkConnector via the Jolokia | ||
| exec API with a benign vm:// URI (brokerConfig=none); patched brokers | ||
| (5.19.4 / 6.2.3) reject vm:// transport for this operation. | ||
| Note: on vulnerable brokers this creates a persistent network | ||
| connector entry that remains until broker restart or manual removal. | ||
|
|
||
| reference: | ||
| - https://nvd.nist.gov/vuln/detail/CVE-2026-34197 | ||
| - https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/ | ||
| - https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog | ||
|
|
||
| profiles: | ||
| - vuln | ||
| - http | ||
| - high_severity | ||
| - cve | ||
| - cve2026 | ||
| - activemq | ||
| - jolokia | ||
| - rce | ||
| - cisa_kev | ||
|
|
||
|
Aarush289 marked this conversation as resolved.
|
||
| payloads: | ||
| - library: http | ||
| steps: | ||
| - method: post | ||
| timeout: 10 | ||
| headers: | ||
| User-Agent: "{user_agent}" | ||
| Content-Type: "application/json" | ||
| Authorization: "Basic YWRtaW46YWRtaW4=" | ||
| ssl: false | ||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" | ||
| prefix: "" | ||
| suffix: "" | ||
| interceptors: | ||
| data: | ||
| schema: | ||
| - "http" | ||
| - "https" | ||
| ports: | ||
| - 8161 | ||
|
There was a problem hiding this comment.
With the default scan settings, an ActiveMQ deployment exposing Jolokia only on its standard port 8161 is never probed: Nettacker runs Useful? React with 👍 / 👎. |
||
| - 80 | ||
| - 443 | ||
|
|
||
| data: | | ||
| {{ | ||
| "type": "exec", | ||
| "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", | ||
|
Aarush289 marked this conversation as resolved.
There was a problem hiding this comment.
On ActiveMQ deployments whose configured broker name is not Useful? React with 👍 / 👎. |
||
| "operation": "addNetworkConnector", | ||
| "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"] | ||
| }} | ||
|
|
||
| response: | ||
| condition_type: and | ||
| conditions: | ||
| status_code: | ||
| regex: '200' | ||
| reverse: false | ||
| content: | ||
| regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)' | ||
| reverse: false | ||
|
|
||
| - method: post | ||
| timeout: 10 | ||
| headers: | ||
| User-Agent: "{user_agent}" | ||
| Content-Type: "application/json" | ||
| Authorization: "Basic YWRtaW46YWRtaW4=" | ||
| ssl: false | ||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" | ||
| prefix: "" | ||
| suffix: "" | ||
| interceptors: | ||
| data: | ||
| schema: | ||
| - "http" | ||
| - "https" | ||
| ports: | ||
| - 8161 | ||
| - 80 | ||
| - 443 | ||
|
|
||
| data: | | ||
| {{ | ||
| "type": "exec", | ||
| "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", | ||
| "operation": "removeNetworkConnector", | ||
| "arguments": ["NC"] | ||
|
Comment on lines
+100
to
+101
There was a problem hiding this comment.
When the target accepts these credentials and already has a legitimate network connector named Useful? React with 👍 / 👎. |
||
| }} | ||
|
|
||
| response: | ||
| save_to_temp_events_only: cleanup_step_1 | ||
| condition_type: and | ||
| conditions: | ||
| status_code: | ||
| regex: '200' | ||
| reverse: false | ||
|
|
||
|
|
||
| - method: post | ||
| timeout: 10 | ||
| headers: | ||
| User-Agent: "{user_agent}" | ||
| Content-Type: "application/json" | ||
| ssl: false | ||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" | ||
| prefix: "" | ||
| suffix: "" | ||
| interceptors: | ||
| data: | ||
| schema: | ||
| - "http" | ||
| - "https" | ||
| ports: | ||
| - 8161 | ||
| - 80 | ||
| - 443 | ||
|
|
||
| data: | | ||
| {{ | ||
| "type": "exec", | ||
| "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", | ||
| "operation": "addNetworkConnector", | ||
| "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"] | ||
| }} | ||
|
|
||
| response: | ||
| condition_type: and | ||
|
Comment on lines
+142
to
+143
There was a problem hiding this comment.
When Jolokia permits unauthenticated access, it also accepts the otherwise identical first probe carrying the default Basic header, so both probe steps match and insert separate vulnerability events for the same endpoint. The events table has no uniqueness constraint or in-scan deduplication, causing duplicated findings and inflated reports for precisely the unauthenticated deployments this fallback targets; conditionally run this variant or suppress a result already reported by the authenticated probe. Useful? React with 👍 / 👎. |
||
| conditions: | ||
| status_code: | ||
| regex: '200' | ||
| reverse: false | ||
| content: | ||
| regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)' | ||
| reverse: false | ||
|
|
||
| - method: post | ||
| timeout: 10 | ||
| headers: | ||
| User-Agent: "{user_agent}" | ||
| Content-Type: "application/json" | ||
| ssl: false | ||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" | ||
| prefix: "" | ||
| suffix: "" | ||
| interceptors: | ||
| data: | ||
| schema: | ||
| - "http" | ||
| - "https" | ||
| ports: | ||
| - 8161 | ||
| - 80 | ||
| - 443 | ||
|
|
||
| data: | | ||
| {{ | ||
| "type": "exec", | ||
| "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", | ||
| "operation": "removeNetworkConnector", | ||
| "arguments": ["NC"] | ||
| }} | ||
|
|
||
| response: | ||
| save_to_temp_events_only: cleanup_step_2 | ||
| condition_type: and | ||
| conditions: | ||
| status_code: | ||
| regex: '200' | ||
| reverse: false | ||
Uh oh!
There was an error while loading. Please reload this page.