Remote Code Execution Vulnerability in Apache ActiveMQ 5.x
Summary
CVE-2015-5254: Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMess... Affects activemq versions < 5.13.2+dfsg-1. Fixed in 5.13.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications through the Java Message Service (JMS). It is widely used for its reliability and scalability in enterprise messaging solutions. However, versions prior to 5.13.0 are vulnerable to a serious security flaw that allows unauthorized remote code execution due to improper serialization restrictions.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5254, arises from Apache ActiveMQ's failure to restrict the classes that can be serialized within the broker. This oversight enables remote attackers to craft malicious serialized JMS ObjectMessage objects, which can lead to arbitrary code execution on the server. The implications of this vulnerability are severe, as it can compromise the integrity and confidentiality of the system, potentially allowing attackers to gain full control over the affected server.
How To Fix
Minimum fixed version
5.13.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing network-level restrictions to limit access to the ActiveMQ broker. This can be done by configuring firewalls to allow only trusted IP addresses to connect to the broker, thereby reducing the risk of exploitation until the upgrade can be performed.
Conclusion
CVE-2015-5254 represents a critical vulnerability in Apache ActiveMQ that can lead to remote code execution. It is essential for users to upgrade to version 5.13.2 or later to mitigate this risk. Additionally, implementing network-level restrictions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for activemq →
FAQ
CVE-2015-5254 is a vulnerability in Apache ActiveMQ that allows remote attackers to execute arbitrary code through crafted serialized JMS ObjectMessage objects.
All versions of Apache ActiveMQ 5.x prior to 5.13.0 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete control over the affected server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2015-5254 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
