Critical Remote Code Execution Vulnerability in Jakarta JMeter
Summary
CVE-2019-0187: Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Affects jakarta-jmeter across 2 version ranges.
< 5b0aff7b31887e4fb512874af1a64f1453765d04
< a4de2de971f0fd06753f4eab5c00f5596dfa75d5
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jakarta JMeter is an open-source tool designed for performance testing and load testing of applications. It allows users to simulate multiple users and analyze the performance of web applications under various conditions. JMeter supports various protocols and can be used for both functional and non-functional testing. However, in its distributed mode, JMeter is vulnerable to a critical security flaw that allows unauthenticated remote code execution (RCE). This vulnerability arises from the lack of encryption and authentication mechanisms in versions prior to 5.1, making it susceptible to attacks when running tests in a distributed environment.
Vulnerability Detail
The vulnerability, identified as CVE-2019-0187, allows an attacker to establish a Remote Method Invocation (RMI) connection to a JMeter server when it is running in distributed mode using the -r or -R command line options. By exploiting this flaw, an attacker can send untrusted data to the server, leading to remote code execution. This poses significant risks, as it could allow unauthorized access to sensitive data, manipulation of test results, or even control over the server itself. The vulnerability affects all versions of JMeter prior to 5.1, which do not implement necessary security measures such as traffic encryption and node authentication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling distributed testing features (-r or -R options) to prevent potential exploitation. Additionally, ensure that the JMeter server is not exposed to untrusted networks and restrict access to trusted IP addresses only.
Conclusion
CVE-2019-0187 presents a significant security risk for users of Jakarta JMeter, particularly when operating in distributed mode. Upgrading to version 5.1 or later is crucial to mitigate this vulnerability. Users should also consider implementing workarounds if immediate upgrades are not possible. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for jakarta-jmeter →
FAQ
CVE-2019-0187 is a critical vulnerability in Jakarta JMeter that allows unauthenticated remote code execution when the tool is used in distributed mode.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to sensitive data, manipulation of test results, and potential control over the JMeter server.
If an immediate upgrade is not feasible, disable distributed testing features and restrict access to the JMeter server from untrusted networks.
The CVSS score of CVE-2019-0187 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for jakarta-jmeter.
