Anonymous LDAP Access Vulnerability in ActiveMQ: Password Verification Flaw
Summary
CVE-2021-26117: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. Affects activemq across 3 version ranges.
< 5.16.1-1
>= 5f0d6943cb97b0570bf8d58e8eaf9f0003a5cb6c, < a0d4141a00ba5de4afaee160836898b41eb28065
< 9768017530fdbbefd7c112b55702b5a16b3f058e
Fixed in 5.16.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications through message queuing. It supports various messaging protocols and is widely used for its reliability and scalability. The vulnerability in question affects the optional LDAP login module, which can be configured to allow anonymous access to the LDAP server, potentially compromising user authentication.
Vulnerability Detail
The vulnerability, identified as CVE-2021-26117, arises from the configuration of the ActiveMQ LDAP login module to permit anonymous access to the LDAP server. In versions prior to 2.16.0 for Apache ActiveMQ Artemis and 5.16.1 and 5.15.14 for Apache ActiveMQ, the system erroneously uses the anonymous context to verify a user's password. This flaw results in a lack of proper password validation, allowing unauthorized access to valid user accounts. The potential ramifications include unauthorized access to sensitive data and system functionalities, posing a significant security risk.
How To Fix
Minimum fixed version
5.16.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable anonymous access to the LDAP server in the ActiveMQ configuration. This can be done by modifying the configuration file (usually located at /etc/activemq/activemq.xml) to ensure that the LDAP login module does not allow anonymous access. Ensure that proper authentication mechanisms are in place to validate user credentials.
Conclusion
The CVE-2021-26117 vulnerability in ActiveMQ poses a significant security risk due to improper password validation when anonymous access is allowed. It is crucial for users of affected versions to upgrade to the latest releases or implement workarounds to mitigate the risk of unauthorized access.
See every vulnerability recorded for activemq →
FAQ
CVE-2021-26117 is a vulnerability in the ActiveMQ LDAP login module that allows for anonymous access, leading to improper password validation.
The affected versions include Apache ActiveMQ Artemis prior to 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14.
The vulnerability can lead to unauthorized access to user accounts, allowing attackers to access sensitive information and functionalities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
