CVE-2020-1941: Apache ActiveMQ XSS Vulnerability
Summary
CVE-2020-1941: In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. Affects activemq versions >= 5.0.0, < 5.15.11. Fixed in 5.15.11. How to fix ↓
Also tracked for
- org.apache.activemq:activemq-web-console · Maven
- activemq · Debian:11
The same CVE-2020-1941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that enables communication between distributed applications. It provides reliable messaging and supports various messaging protocols. The webconsole admin GUI is a component of Apache ActiveMQ that allows administrators to manage and monitor message queues. This vulnerability affects Apache ActiveMQ versions 5.0.0 to 5.15.11.
Vulnerability Detail
The webconsole admin GUI in Apache ActiveMQ is susceptible to a cross-site scripting (XSS) attack. Specifically, the view that lists the contents of a queue is vulnerable. An attacker can exploit this vulnerability by injecting malicious scripts or HTML code into the queue contents, which will then be executed when viewed through the webconsole admin GUI. This can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
5.15.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the webconsole admin GUI. This can be done by modifying the configuration settings of Apache ActiveMQ to disable the webconsole or restrict access to trusted IP addresses only. However, this workaround may limit the functionality and convenience of managing and monitoring message queues through the webconsole.
Conclusion
The XSS vulnerability in the webconsole admin GUI of Apache ActiveMQ can be exploited by attackers to execute malicious code or steal sensitive information. It is crucial to upgrade to the latest version of Apache ActiveMQ (5.15.11 or later) to mitigate this vulnerability. Additionally, users can temporarily disable or restrict access to the webconsole admin GUI as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Apache ActiveMQ is an open-source message broker that enables communication between distributed applications.
The webconsole admin GUI is a component of Apache ActiveMQ that allows administrators to manage and monitor message queues.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker can inject malicious scripts or HTML code into a trusted website or application, which is then executed by unsuspecting users.
This vulnerability can lead to unauthorized access, data theft, or other malicious activities. An attacker can exploit the XSS vulnerability to execute arbitrary code or steal sensitive information from the webconsole admin GUI.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache ActiveMQ installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
