Apache ActiveMQ 6.x Unauthenticated Jolokia and Message REST API Exposure

This repository is a research archive centered on Apache ActiveMQ Classic exploitation, not a single minimal PoC. It contains: (1) an original CVE-2026-34197 reproduction directory with Python exploit scripts, malicious Spring XML payloads, and a Docker lab; (2) a re-audit directory validating the RCE across multiple ActiveMQ versions with improved PoCs and bash automation; (3) a live re-audit for CVE-2026-42588 and CVE-2026-42253 with dedicated PoCs; and (4) a broader 6.2.6 source audit and findings ledger. Main exploit capability: the core exploit abuses the Jolokia JMX-over-HTTP endpoint on the ActiveMQ web console to invoke BrokerView.addNetworkConnector or addConnector with a crafted discovery URI. That URI embeds vm:// plus brokerConfig=xbean:<resource>, causing VMTransportFactory/XBeanBrokerFactory to load attacker-controlled Spring XML. The XML eagerly instantiates beans such as ProcessBuilder or Runtime.exec gadgets, yielding arbitrary command execution before broker validation. The repo demonstrates both the original remote-HTTP XML delivery (CVE-2026-34197) and the later patch-bypass logic (CVE-2026-42588), including no-paren/composite wrapper variants and a local-file xbean payload path. The exploit code is operational rather than framework-based. The Python scripts are self-contained and use only the standard library. They can host the malicious XML over an embedded HTTP server, probe Jolokia availability, discover broker names, send authenticated Jolokia exec requests with Basic auth and Origin headers, and wait for payload fetches as a success signal. The re-audit PoC in 02-reaudit-apr30/pocs/poc.py fixes earlier payload/server-timing issues and is the cleanest working implementation in the repo. A secondary exploit capability is included for CVE-2026-42253. The script 03-reaudit-42588-42253/lab/pocs/poc_42253.py targets /api/message/<queue> and demonstrates attacker-controlled JMS properties being reflected into HTTP response headers by MessageServlet, enabling arbitrary header injection, Content-Type override, cookie injection, and stored XSS. Fingerprintable targets and infrastructure are clear: the target service is ActiveMQ web console/Jolokia on port 8161, with OpenWire on 61616 in the lab. The exploit posts to /api/jolokia/, reads broker MBeans via /api/jolokia/read/..., and in the XSS PoC uses /api/message/<dest>. Attacker infrastructure is an HTTP server on ports 8888, 8889, or 9999 serving XML such as /poc-payload.xml, /evil.xml, or /poc.xml. Proof artifacts are written under /tmp on the target. Overall purpose: the repository documents exploit development, regression testing, and patch-bypass analysis for ActiveMQ Classic RCE, then extends into a broader security review of the fixed 6.2.6 release. It is a genuine exploit repository with working code, lab automation, and detailed writeups rather than a detection-only or fake project.

This repository is a standalone Java Swing exploit toolkit for Apache ActiveMQ, not a Metasploit/Nuclei module. The project is Maven-based, with a single executable entry point in src/main/java/cc/kiiy/App.java that launches a GUI (MainFrame). The codebase is organized into service classes for exploitation/detection logic (EnvironmentService, VulnerabilityService), UI panels for each supported CVE and settings, and utility helpers for HTTP and local config handling. Core capability-wise, the tool supports both detection and exploitation. EnvironmentService fingerprints ActiveMQ by requesting the target URL and checking for the Apache ActiveMQ title, and can authenticate to /admin/ using HTTP Basic auth to extract hostname, version, and uptime from the admin console HTML. VulnerabilityService is the main exploit engine. For CVE-2015-5254, it accepts a user-provided Base64 serialized payload, decodes it, wraps it into an ActiveMQObjectMessage, and sends it over OpenWire/JMS to a chosen queue on tcp://<host>:<port> (default 61616), enabling broker-side deserialization when the message is processed/viewed. For CVE-2016-3088, it performs a PUT to /fileserver/<random>.txt and then a MOVE to file:///etc/cron.d/root, planting a cron entry that launches a Perl reverse shell back to the operator. This is a real exploitation path, not just a detector, but it depends on vulnerable behavior and elevated target privileges. The repository also includes support for CVE-2022-41678 workflows. Although the provided content truncates some of the implementation, the UI and service references clearly show functionality to write a default or custom webshell and then execute commands through it, with selectable methods such as auto, log4j2, and jfr. The included JfrTemplate.java contains a large embedded JFR configuration template, indicating one exploitation path abuses JFR-related file write/config behavior. BeanXmlPanel generates Spring BeanXML payloads using java.lang.ProcessBuilder for arbitrary command execution, likely intended to support XML-based ActiveMQ exploitation such as CVE-2023-46604-style xbean loading. The code also contains logic for a Jolokia-based probe labeled CVE-2026-34197 that sends an addNetworkConnector request with a vm://evil?brokerConfig=xbean:<xmlServer> argument, causing the target to fetch attacker-controlled XML from an external server. Network and fingerprintable artifacts are abundant: HTTP(S) access to the target web console and admin paths, OpenWire TCP access to port 61616, PUT/MOVE requests to /fileserver/, file destinations like file:///etc/cron.d/root, attacker XML hosting URLs, and Basic Authorization headers. The GUI exposes global custom headers and proxy settings, allowing the operator to tune requests and route traffic through a local proxy. Overall, this is an operational multi-CVE ActiveMQ exploitation toolkit with a GUI front end, combining reconnaissance, authenticated checks, payload generation, deserialization delivery, arbitrary file write abuse, XML-based RCE testing, and webshell management.

This repository is a small, functional proof-of-concept exploit for Apache ActiveMQ, targeting CVE-2024-32114 and the version range noted in the README as 6.0.0-6.1.1. The repository contains three files: a minimal README, a Python exploit script (poc.py), and a malicious Spring XML bean definition (evil.xml). The main exploit logic is in poc.py. It uses Python requests to send JSON POST requests to the target's Jolokia endpoint at /api/jolokia. First, it attempts cleanup by calling removeNetworkConnector("NC") on the ActiveMQ Broker MBean, likely to remove a leftover connector from prior runs. It then builds a malicious connector URI using the static:(vm://...) transport syntax with a brokerConfig=xbean: parameter pointing to an attacker-controlled URL hosting evil.xml. The script invokes addNetworkConnector(java.lang.String) on the same Broker MBean, causing the target to fetch and parse the remote XML. The evil.xml file contains a Spring beans definition that instantiates java.lang.ProcessBuilder with init-method="start". Its constructor arguments execute bash -c 'touch /tmp/pwned_RCE', demonstrating remote command execution by creating a file on the target system. This confirms the exploit is not merely a detector; it actively attempts RCE. The exploit is network/web-based because it abuses an exposed HTTP management interface. It appears operational rather than weaponized: it includes a working payload and attacker infrastructure reference, but customization is manual and minimal. Fingerprintable observables include the target ActiveMQ host and Jolokia endpoint, the attacker-hosted evil.xml URL, the malicious brokerConfig xbean URI pattern, and the created file path /tmp/pwned_RCE.

This repository is a standalone Python proof-of-concept exploit for alleged CVE-2026-34197, targeting Apache ActiveMQ Classic through the Jolokia HTTP API. The repository contains five files: a main exploit script (exploit.py), a malicious Spring XML template (payloads/template.xml), a Docker lab definition for a vulnerable ActiveMQ instance (docker/docker-compose.yml), a README with exploitation flow and usage examples, and a license file. The exploit’s core capability is authenticated or optionally unauthenticated remote code execution against exposed ActiveMQ web consoles. The Python script verifies access to the Jolokia endpoint, attempts to detect the broker name, starts a local HTTP server on an attacker-controlled host and port, generates or loads a Spring XML payload, and then triggers the target to fetch that XML via a crafted VM transport / XBean brokerConfig URI. The XML payload uses MethodInvokingFactoryBean to call java.lang.Runtime.getRuntime().exec() and execute an arbitrary shell command through /bin/bash -c. The README demonstrates simple command execution and reverse shell usage. Operationally, the exploit depends on the target reaching back to the attacker over HTTP to download /payload.xml. The main fingerprintable target endpoint is /api/jolokia/ on the ActiveMQ web console, typically exposed on TCP 8161. The lab environment also exposes 61616 (OpenWire) and 5672 (AMQP), though the exploit itself is centered on the web/Jolokia path. The repository is not part of a larger exploit framework; it is a self-contained PoC with a hardcoded but user-supplied command payload, making it best classified as OPERATIONAL rather than framework-weaponized.

This repository is a small standalone Python exploit for Apache ActiveMQ Classic RCE via the Jolokia API. It contains three files: a minimal README, the main exploit script exp.py, and a malicious Spring XML template payload.xml. The exploit is not part of a major framework. The core capability is remote command execution. The Python script accepts a target Jolokia base URL, attacker host/port, command to execute, optional credentials, a no-auth mode, and an optional broker name. It first verifies target reachability by requesting the Jolokia endpoint at /api/jolokia/. It then attempts to determine the broker name (the full implementation is truncated in the provided content, but main() clearly calls obtener_broker_name()). After that, it generates a malicious Spring XML payload that invokes java.lang.Runtime.getRuntime().exec() through MethodInvokingFactoryBean, wrapping the operator command in /bin/bash -c. The command is XML-escaped before insertion, which the README explicitly mentions as a fix for reverse shell reliability. Operationally, the script starts a local HTTP server using Python's http.server to host the XML payload and records whether the target fetched it. The exploit then abuses the Jolokia-exposed addNetworkConnector functionality to coerce ActiveMQ into loading attacker-controlled XML via xbean/vm-related configuration handling, resulting in code execution on the broker. This makes the exploit a practical operational PoC rather than a mere detector. Notable fingerprintable elements include the Jolokia endpoint /api/jolokia/, the local payload file payload.xml, the optional template path payloads/template.xml, and the Spring schema URLs embedded in the XML. The exploit requires network connectivity from the target broker back to the attacker-controlled HTTP server. Based on the code comments, it targets Apache ActiveMQ Classic versions < 5.19.4 and 6.0.0–6.2.2, with unauthenticated exploitation supported for 6.0.0–6.1.1 via CVE-2024-32114 conditions.

Repository is a small standalone Python proof-of-concept exploit for Apache ActiveMQ Classic RCE via the Jolokia API, identified in the repo as CVE-2026-34197. It is not part of a larger exploit framework. The main logic is in exploit.py, supported by a malicious Spring XML template in payloads/template.xml and a docker-compose lab for a vulnerable ActiveMQ 5.18.6 instance. Exploit flow: the script accepts a target URL, attacker host/port, command, and optional credentials. It first checks connectivity to the target Jolokia endpoint at /api/jolokia/, then attempts to determine the broker name. It starts a local HTTP server to host a generated XML payload. The payload is a Spring beans document that uses MethodInvokingFactoryBean to call java.lang.Runtime.getRuntime().exec() with /bin/bash -c <command>. The exploit then sends a Jolokia request invoking addNetworkConnector with a crafted vm:// URI containing brokerConfig=xbean:http://<attacker>:<port>/payload.xml. If successful, the target broker fetches the XML from the attacker server and executes the supplied command. Capabilities: authenticated or optionally unauthenticated remote code execution against exposed Jolokia, attacker-controlled command execution, and support for reverse-shell style commands if provided manually. The included HTTP server also gives a basic confirmation signal by logging when the target retrieves the XML payload. Repository structure: README.md documents the vulnerability, usage, indicators, and remediation; exploit.py is the operational PoC; payloads/template.xml is the reusable malicious XML template; docker/docker-compose.yml provides a local vulnerable test environment exposing ports 8161, 61616, and 5672. Overall, this is a real exploit PoC with a hardcoded but operator-supplied command payload, making it operational rather than merely demonstrative.