EOL Fix Available | CVE-2022-35278

Overview

Apache ActiveMQ Artemis is an open-source, asynchronous messaging broker supporting the JMS, AMQP, MQTT, STOMP and Core protocols. It is widely deployed as the messaging backbone of Java applications, including as the embedded broker used by Spring Boot. Artemis ships a web console for administering the broker, which lists addresses, queues, connections, sessions and messages.

A content spoofing vulnerability (CVE-2022-35278) has been identified in the Apache ActiveMQ Artemis web console, which allows attackers to show malicious content and to link administrators to a malicious URL from inside a console page they trust, by putting HTML in the name of an address or queue.

Per OWASP: content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application; when an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user, presenting the user with a modified page under the context of the trusted domain.

This issue affects multiple versions of Apache ActiveMQ Artemis.

‍

Details

Module Info

Product: Apache ActiveMQ Artemis
Affected packages: org.apache.activemq:artemis-plugin, org.apache.activemq:artemis-console
Affected versions: >=2.16.0 <2.24.0
GitHub repository: https://github.com/apache/artemis
Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-server
Package manager: Maven
Fixed in: NES for ActiveMQ Artemis 2.19.1-artemis-server-2.19.3

Vulnerability Info

This Medium-severity vulnerability is found in the web console of multiple versions of Apache ActiveMQ Artemis. The console's table views built each linked cell by concatenating the cell value into an HTML string:

{ header: 'Name', itemField: 'name',
  templateFn: function(value, item) { return '<a href="#" onclick="selectQueue(' + item.idx + ')">' + $sanitize(value) + '</a>' }
},

A column declared with templateFn is rendered by the table component through ng-bind-html with $sce.trustAsHtml, which deliberately bypasses the framework's sanitizer. The only filtering applied was the plugin's own $sanitize call, and that filter permits a whitelist of benign elements, anchors among them. Markup placed in an address or queue name therefore survives into the rendered page.

Anyone able to create or auto-create a destination controls a name that the console renders, and auto-created destinations mean an ordinary producer can be enough. Script and event handlers are removed by the sanitizer, so the consequence is injected content and links rather than script execution, and an administrator must view the affected page.

The advisory records this as affecting all versions before 2.24.0. The templateFn pattern shown above arrived with the HawtIO 2 console, first released in 2.16.0; earlier releases shipped a different console implementation whose exposure has not been confirmed.

This vulnerability was introduced in 2020 with Apache ActiveMQ Artemis 2.16.0.

‍

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. The affected 2.19.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix (2.24.0 or later).
Leverage a commercial support partner like HeroDevs for post-EOL security support.

There is no configuration workaround, because the flaw is in how the console renders names. Restricting console access to trusted administrators reduces exposure but does not remove it, since the payload is planted by whoever can name a destination rather than by whoever views the page.

‍