CVEs - Accessible ActiveMQ Service Report

The Apache ActiveMQ Service - Known Exploited Vulnerabilities in ActiveMQ

Description

The ActiveMQ Service is a Java-based open source project developed by the Apache Software Foundation.  There are currently two (2) versions of ActiveMQ: Classic and Artemis.  Apache plan to support only the ActiveMQ Artemis version once Artemis has evolved to include all of the features curently available in the Classic version.

The ActiveMQ project was originally created by its founders from LogicBlaze in 2004, as an open source message broker, hosted by CodeHaus.  The code and ActiveMQ trademark were donated to the Apache Software Foundation in 2007, where the founders continued to develop the codebase with the extended Apache community.

The Apache Software Foundation developed ActiveMQ into an open source protocol which functions as an implementation of message-oriented middleware (MOM).  Its basic function is to send messages between different applications, but includes additional features like the Simple Text Oriented Message Protocol (STOMP), Java Message Service (JMS), and the OpenWire Protocol.

Message brokers like Apache ActiveMQ are often found in enterprise systems — or any systems that have a complex architecture.  The goal of the implementation is to create reliable communication between the various components of the enterprise system.

ActiveMQ Artemis is an open source project for an asynchronous messaging system.   It originates from the HornetQ messaging system which was donated to Apache in 2014.   It retains compatibility with HornetQ while adding many interesting features.  It is high performance, embeddable, clustered and supports multiple protocols.  JBoss EAP 7 uses Apache ActiveMQ Artemis as its JMS broker and is configured using the messaging-activemq subsystem.

ActiveMQ Artemis has a plugable protocol architecture.  Protocol plugins come in the form of ActiveMQ Artemis protocol modules.  Each protocol module can be added to the brokers class path and are loaded by the broker at boot time.

ActiveMQ Artemis ships with 5 protocol modules out of the box.  The five (5) modules offer support for the protocols listed below.  In addition to the protocols ActiveMQ Artemis support, it also offers support for it's own highly performant native protocol "Core".

ActiveMQ Artemis offer support for the following Protocols.

The Apache ActiveMQ Service listens on port 61616/TCP.

Problem

CVE-2026-34197 in Apache ActiveMQ is a high-severity remote code execution flaw that stems from insecure handling of the Jolokia management API, where attackers can send crafted requests that force the broker to load a malicious remote configuration (e.g., a Spring XML file) and execute arbitrary system commands during initialization

Although the vulnerability typically requires authenticated access, real-world exploitation is made practical because default credentials are often left unchanged or because a separate issue can expose the API without authentication, effectively lowering the barrier to entry. Threat actors are actively exploiting this by targeting exposed ActiveMQ instances, abusing the management interface to achieve full control of the broker

CVE-2023-46604 is a vulnerability that exists in two different customer environments.  In both instances, the adversary attempted to deploy ransomware binaries on target systems in an effort to ransom the victim organisations.  Based on the ransom note and available evidence, the activity was attributed to the HelloKitty ransomware family, whose source code was leaked on a forum in early October 2023.  Rapid7 observed similar indicators of compromise across the affected customer environments, both of which were running outdated versions of Apache ActiveMQ.

On the 20th Nov 2023, the Cyber Security Company Trend Micro reported the active exploitation of the CVE-2023-46604 vulnerability to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.

Recommendations.

Secure ActiveMQ by minimising exposure, enforcing strong authentication and least-privilege authorisation, disabling unnecessary interfaces and features, and keeping the system continuously patched and monitored for suspicious activity.

Common Vulnerabilities & Exposures (CVEs)

Systems used for reporting and assessing the severity of security vulnerabilities.

CVSSv3.0 Metrics.

Additional Information