CVE-2020-26217: Remote Code Execution in Apache ActiveMQ
Summary
CVE-2020-26217: XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Affects activemq versions >= 5.15.4, <= 5.15.4. No fix is published. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
- com.thoughtworks.xstream:xstream · Maven
The same CVE-2020-26217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It is widely used in enterprise systems for its support of various messaging protocols and flexible architecture. However, ActiveMQ versions prior to 5.15.4 are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability in ActiveMQ is due to a flaw in XStream, a Java library used for serialization. This flaw allows a remote attacker to execute arbitrary shell commands by manipulating the input stream. It is important to note that only users who rely on blocklists are affected, while those using XStream's Security Framework allowlist are not vulnerable. The impact of this vulnerability is high, as it can lead to unauthorized remote code execution and compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
For users who cannot immediately upgrade to the latest version, the linked advisory provides code workarounds to mitigate the vulnerability. These workarounds should be implemented until the upgrade can be performed.
Conclusion
The vulnerability in Apache ActiveMQ versions prior to 5.15.4 can lead to remote code execution if exploited. It is crucial to upgrade to the latest version or apply the provided workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Users of Apache ActiveMQ versions prior to 5.15.4 who rely on blocklists are affected by this vulnerability.
The vulnerability allows a remote attacker to execute arbitrary shell commands, potentially leading to unauthorized remote code execution and compromise of the affected system.
The recommended fix is to upgrade to Apache ActiveMQ version 5.15.4 or later, which includes a fix for the XStream vulnerability.
No, users who rely on XStream's Security Framework allowlist are not affected by this vulnerability.
More information about this vulnerability can be found in the linked advisory provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
