AI analysis
When an Apache Artemis or Apache ActiveMQ Artemis broker processes message-based management requests, it deserializes certain method parameters—including ones the broker does not actually use—and the permitted types can be abused to craft a payload that forces excessive computation, pinning the processing thread and causing a denial of service. Triggering the flaw requires an authenticated messaging client that is authorized with the MANAGE permission to perform management-via-messaging, so anonymous or unprivileged clients cannot exploit it. An attacker with such access can repeatedly submit crafted management messages to tie up broker processing capacity, degrading or blocking message handling. Affected deployments run Apache ActiveMQ Artemis 1.3.0 through 2.44.0 or Apache Artemis 2.50.0 through 2.56.0; the fix ships in version 2.57.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue has not yet been scored under CVSS.
What to do: Upgrade to Apache Artemis 2.57.0, which fixes the issue. As an interim measure, audit which messaging users hold the MANAGE permission for management-via-messaging, restrict it to strictly trusted clients, and disable management-via-messaging on brokers that do not use the feature. Monitor broker processing threads for long-running, CPU-bound management-message handling as a sign of attempted abuse.
Affected
| Apache Artemis | 2.50.0 through 2.56.0 |
| Apache ActiveMQ Artemis | 1.3.0 through 2.44.0 |
Estimated exposure
largeon the order of tens of thousands of broker deployments; only those with management-via-messaging enabled and a MANAGE-authorized messaging client are… — No install counts were provided, so this is an order-of-magnitude estimate based on ActiveMQ Artemis's broad enterprise adoption as an open-source message broker and its bundling in commercial offerings and application-server messaging,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.