CVE-2021-26117: Improper Authentication in Apache ActiveMQ and Apache Artemis
Summary
CVE-2021-26117: Improper Authentication in Apache ActiveMQ and Apache Artemis. Affects org.apache.activemq:activemq-parent across 2 version ranges.
< 5.15.14
>= 5.16.0, < 5.16.1
Fixed in 5.15.14 or 5.16.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-26117 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ and Apache Artemis are open-source messaging and integration patterns servers. They provide reliable messaging between distributed applications. The optional ActiveMQ LDAP login module allows users to authenticate using an LDAP server. However, a vulnerability in the authentication process allows anonymous access to the LDAP server, leading to improper authentication. This vulnerability affects Apache ActiveMQ Artemis versions prior to 2.16.0 and Apache ActiveMQ versions prior to 5.16.1 and 5.15.14.
Vulnerability Detail
The vulnerability arises when the optional ActiveMQ LDAP login module is configured to use anonymous access to the LDAP server. In this scenario, the anonymous context is mistakenly used to verify a valid user's password, resulting in no password check. This allows unauthorized users to bypass authentication and gain unauthorized access to the messaging server. The impact of this vulnerability can be severe, as it compromises the security and integrity of the messaging system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.15.145.15.14 -
>= 5.16.0, < 5.16.15.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the ActiveMQ LDAP login module or configure it to use authenticated access instead of anonymous access. This can be done by modifying the configuration files of the messaging server. However, it is strongly advised to apply the official fix by upgrading to the patched versions as soon as possible.
Conclusion
The vulnerability in Apache ActiveMQ and Apache Artemis allows unauthorized access to the messaging server through improper authentication. It is crucial to upgrade to the fixed versions or apply the recommended workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-parent →
FAQ
The vulnerability allows unauthorized users to bypass authentication and gain unauthorized access to the messaging server, compromising its security and integrity.
Apache ActiveMQ Artemis versions prior to 2.16.0 and Apache ActiveMQ versions prior to 5.16.1 and 5.15.14 are affected.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache ActiveMQ Artemis (2.16.0 or later) or Apache ActiveMQ (5.16.1 or later).
Yes, a temporary workaround is to disable the ActiveMQ LDAP login module or configure it to use authenticated access instead of anonymous access. However, it is strongly advised to apply the official fix by upgrading to the patched versions.
You can find more information about this vulnerability in the CVE-2021-26117 advisory and the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-parent.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
