CVE-2020-13932: Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
Summary
CVE-2020-13932: Cross-site Scripting (XSS) in Apache ActiveMQ Artemis. Affects org.apache.activemq:apache-artemis versions >= 2.5.0, < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ Artemis is an open-source message broker that implements the Java Message Service (JMS) API. It provides messaging capabilities for applications, allowing them to exchange data asynchronously. The vulnerability identified as CVE-2020-13932 affects Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0. This vulnerability allows an attacker to inject a specially crafted MQTT packet with an XSS payload as the client-id or topic name. When the admin console's browser processes this payload, it triggers a cross-site scripting attack. The XSS payload is specifically triggered in the diagram plugin, queue node, and the info section.
Vulnerability Detail
The CVE-2020-13932 vulnerability in Apache ActiveMQ Artemis enables an attacker to execute cross-site scripting attacks. By crafting a malicious MQTT packet with an XSS payload as the client-id or topic name, the attacker can inject code into the admin console's browser. This payload is then executed in the diagram plugin, queue node, and the info section. The impact of this vulnerability includes the potential for unauthorized access, data theft, and the execution of arbitrary code within the context of the admin console's browser.
How To Fix
Minimum fixed version
2.14.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the admin console of Apache ActiveMQ Artemis. By limiting access to trusted individuals or IP addresses, the risk of exploitation can be reduced. However, this workaround may impact the usability and functionality of the admin console, so upgrading to the fixed version is the recommended solution.
Conclusion
The CVE-2020-13932 vulnerability in Apache ActiveMQ Artemis exposes the admin console's browser to cross-site scripting attacks. Upgrading to the fixed version, 2.14.0 or later, is the recommended solution to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:apache-artemis →
FAQ
Apache ActiveMQ Artemis is an open-source message broker that implements the Java Message Service (JMS) API. It provides messaging capabilities for applications, allowing them to exchange data asynchronously.
The vulnerability affects Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0.
The vulnerability allows an attacker to inject a specially crafted MQTT packet with an XSS payload as the client-id or topic name. When the admin console's browser processes this payload, it triggers a cross-site scripting attack.
The vulnerability can lead to unauthorized access, data theft, and the execution of arbitrary code within the context of the admin console's browser.
To mitigate the vulnerability, it is recommended to upgrade to Apache ActiveMQ Artemis version 2.14.0 or later, which includes the necessary security patches.
