Add ActiveMQ Jolokia RCE Detection Module (CVE-2026-34197) (Fixes #1507)#1531
Open
Aarush289 wants to merge 19 commits intoOWASP:masterfrom
Open
Add ActiveMQ Jolokia RCE Detection Module (CVE-2026-34197) (Fixes #1507)#1531Aarush289 wants to merge 19 commits intoOWASP:masterfrom
Aarush289 wants to merge 19 commits intoOWASP:masterfrom
Conversation
create pr
Document all modules ( fix OWASP#1269 ) (OWASP#1270)
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Removed entry for FortiWeb authentication bypass vulnerability. Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Merge new changes
Merge new modules
Pull the changes
merge the changes
Add the new changes
MERGE NEW changes
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Summary by CodeRabbit
WalkthroughAdds a new Nettacker vulnerability module for CVE-2026-34197 (Apache ActiveMQ Jolokia RCE) and registers it in ChangesActiveMQ CVE-2026-34197 module
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce_vuln`:
- Line 54: The module hardcodes the MBean ObjectName
("org.apache.activemq:type=Broker,brokerName=localhost") which only detects
brokers using the default brokerName; update the module
activemq_cve_2026_34197_jolokia_rce_vuln to either (A) document this limitation
in the module description or (B) implement broker-name discovery before
exploitation by calling Jolokia's "list" operation to enumerate
org.apache.activemq:type=Broker entries, extract the actual brokerName, and
template that value into the MBean string used for the exploit payload; locate
references to the literal "org.apache.activemq:type=Broker,brokerName=localhost"
and replace with a discovered/template variable or add the documentation note.
- Around line 5-10: Update the module description (the YAML "description" block)
to remove the claim that the probe is safe/read-only and instead clearly state
that the module invokes addNetworkConnector via Jolokia which will create a
persistent network connector entry (e.g.
"static:(vm://nettacker-probe-000?brokerConfig=none)") that remains until broker
restart or explicit removal and which the broker will attempt to start; mention
this is the reliable detection path for CVE-2026-34197 and warn operators not to
run against production brokers unless they accept these side effects.
- Line 1: The module file missing the .yaml extension will not be loaded by the
TemplateLoader; rename the file from activemq_cve_2026_34197_jolokia_rce_vuln to
activemq_cve_2026_34197_jolokia_rce_vuln.yaml so it matches other vulnerability
modules and the loader’s expected pattern; ensure any references to the module
name in the repo (if any) are updated to the new filename so registration works
correctly.
- Around line 26-106: Split the single payload that contains two post steps into
two independent payloads: one payload that includes the Authorization header
("Authorization: \"Basic YWRtaW46YWRtaW4=\"") and targets the nettacker_fuzzer
URL with the exec addNetworkConnector data, and a separate payload that omits
the Authorization header but otherwise uses the same method/post, timeout,
headers (User-Agent, Content-Type), url (nettacker_fuzzer), and JSON data (type
exec, mbean org.apache.activemq:type=Broker,brokerName=localhost, operation
addNetworkConnector, arguments
["static:(vm://nettacker-probe-000?brokerConfig=none)"]); ensure each payload
has its own response checks (status_code 200 and content regex matching
addNetworkConnector and org.apache.activemq) so one can succeed/fail
independently, and optionally gate the unauthenticated payload to run only if
the authenticated payload fails to avoid double-mutating the broker state.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a014e098-47d6-4992-84da-cf54fb8d5695
📒 Files selected for processing (2)
docs/Modules.mdnettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce_vuln
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (3)
nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml (3)
5-10:⚠️ Potential issue | 🟡 MinorDescription still misleadingly calls the probe "safe".
addNetworkConnectoris a state-mutating operation: on a vulnerable broker this call creates a persistent network connector entry (static:(vm://nettacker-probe-000?brokerConfig=none)) that the broker will attempt to start and that survives until restart or manual removal. Please update the description to reflect this so operators don't run the module against production brokers expecting it to be side-effect free.📝 Suggested wording
description: | Detects CVE-2026-34197 in Apache ActiveMQ Classic via Jolokia API. The vulnerability allows execution of addNetworkConnector which can load remote configuration via vm:// and xbean: protocol. - This module sends a safe detection payload and checks for successful - execution indicators in the response. + Detection invokes addNetworkConnector via the Jolokia exec API with a + benign vm:// URI (brokerConfig=none); patched brokers (5.19.4 / 6.2.3) + reject vm:// transport for this operation. + Note: on vulnerable brokers this creates a persistent network connector + entry that remains until broker restart or manual removal.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml` around lines 5 - 10, Update the module description to remove the claim that the probe is "safe" and explicitly state that invoking addNetworkConnector is state-mutating: it will create a persistent network connector entry (e.g. static:(vm://nettacker-probe-000?brokerConfig=none)) that the broker will attempt to start and which persists until broker restart or manual removal; ensure the description around the detection payload and response checks (referencing addNetworkConnector) warns operators not to run this against production brokers expecting side-effect-free behavior.
26-106:⚠️ Potential issue | 🟠 MajorAuthenticated and unauthenticated probes should be separate payloads.
Both probes are still nested as two
steps:under a single payload. They target distinct deployment shapes (default-credential brokers vs. CVE-2024-32114-affected unauth Jolokia in 6.0.0–6.1.1), so on an auth-required broker step 2 will always 401 and never match even when step 1 succeeds — and vice versa on an unauth instance. Splitting them into two independentpayloadslets each succeed/fail on its own and keeps reporting clean. Optionally gate the unauth payload on the auth payload failing to avoid double-mutating vulnerable brokers.♻️ Restructure into two payloads
payloads: - library: http steps: - method: post timeout: 10 headers: User-Agent: "{user_agent}" Content-Type: "application/json" Authorization: "Basic YWRtaW46YWRtaW4=" ssl: false url: nettacker_fuzzer: input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" prefix: "" suffix: "" interceptors: data: schema: - "http" - "https" ports: - 8161 - 80 - 443 data: | {{ "type": "exec", "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", "operation": "addNetworkConnector", "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"] }} response: condition_type: and conditions: status_code: regex: '200' reverse: false content: regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)' reverse: false - - - method: post + + - library: http + steps: + - method: post timeout: 10 headers: User-Agent: "{user_agent}" Content-Type: "application/json" ssl: false url: nettacker_fuzzer: input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/" prefix: "" suffix: "" interceptors: data: schema: - "http" - "https" ports: - 8161 - 80 - 443 data: | {{ "type": "exec", "mbean": "org.apache.activemq:type=Broker,brokerName=localhost", "operation": "addNetworkConnector", "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"] }} response: condition_type: and conditions: status_code: regex: '200' reverse: false content: regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)' reverse: false🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml` around lines 26 - 106, The current payload bundles both authenticated and unauthenticated probes as two steps under a single payload, which causes false negatives because an auth-required broker will 401 on the unauth step and an unauthenticated Jolokia will 401 on the auth step; split them into two separate payload objects under "payloads": one payload containing the post step that includes the Authorization header (the authenticated probe) and a second payload containing the post step without Authorization (the unauthenticated probe), preserving the same url, data and response checks for each; optionally implement a gating mechanism so the unauth payload only runs if the authenticated payload fails (keep the existing "method: post" blocks, headers entries and response checks intact but move each into its own top-level payload entry).
54-54:⚠️ Potential issue | 🟡 MinorHardcoded
brokerName=localhostwill miss customized brokers.Operators who set a non-default
<broker brokerName="...">inactivemq.xmlwill not match this MBean ObjectName and the module will report no vulnerability even when the broker is exploitable. Acceptable as a baseline, but please at minimum document this limitation in the description, or consider a follow-up that issues a Jolokialist/searchto discover the actual broker name and templates it into the exec payload.Also applies to line 93.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml` at line 54, The hardcoded MBean ObjectName "mbean": "org.apache.activemq:type=Broker,brokerName=localhost" (and its duplicate occurrence) will miss non-default brokerName values; either update the module to discover broker names via a Jolokia list/search and template the actual brokerName into the payload before use, or at minimum document this limitation in the module description. Locate the "mbean" entries in activemq_cve_2026_34197_jolokia_rce.yaml and replace the fixed brokerName with a discovery step that queries Jolokia for "org.apache.activemq:type=Broker,brokerName=*" and extracts the real brokerName to use, or change the mbean to use a wildcard form and ensure the rest of the payload accepts a discovered brokerName, and add clear documentation in the description about the prior localhost-only assumption.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml`:
- Around line 5-10: Update the module description to remove the claim that the
probe is "safe" and explicitly state that invoking addNetworkConnector is
state-mutating: it will create a persistent network connector entry (e.g.
static:(vm://nettacker-probe-000?brokerConfig=none)) that the broker will
attempt to start and which persists until broker restart or manual removal;
ensure the description around the detection payload and response checks
(referencing addNetworkConnector) warns operators not to run this against
production brokers expecting side-effect-free behavior.
- Around line 26-106: The current payload bundles both authenticated and
unauthenticated probes as two steps under a single payload, which causes false
negatives because an auth-required broker will 401 on the unauth step and an
unauthenticated Jolokia will 401 on the auth step; split them into two separate
payload objects under "payloads": one payload containing the post step that
includes the Authorization header (the authenticated probe) and a second payload
containing the post step without Authorization (the unauthenticated probe),
preserving the same url, data and response checks for each; optionally implement
a gating mechanism so the unauth payload only runs if the authenticated payload
fails (keep the existing "method: post" blocks, headers entries and response
checks intact but move each into its own top-level payload entry).
- Line 54: The hardcoded MBean ObjectName "mbean":
"org.apache.activemq:type=Broker,brokerName=localhost" (and its duplicate
occurrence) will miss non-default brokerName values; either update the module to
discover broker names via a Jolokia list/search and template the actual
brokerName into the payload before use, or at minimum document this limitation
in the module description. Locate the "mbean" entries in
activemq_cve_2026_34197_jolokia_rce.yaml and replace the fixed brokerName with a
discovery step that queries Jolokia for
"org.apache.activemq:type=Broker,brokerName=*" and extracts the real brokerName
to use, or change the mbean to use a wildcard form and ensure the rest of the
payload accepts a discovered brokerName, and add clear documentation in the
description about the prior localhost-only assumption.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b480af5a-4bb4-4b44-abfb-7850c26e6ef6
📒 Files selected for processing (1)
nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml
Aarush289
force-pushed
the
CVE-2026-34197
branch
2 times, most recently
from
dbdd592 to
c6f3ac4
Compare
securestep9
requested changes
Apr 27, 2026
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Collaborator
|
@coderabbitai full review |
Contributor
✅ Actions performedFull review triggered. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Adds a new Nettacker module to detect CVE-2026-34197 in Apache ActiveMQ via the Jolokia API.
Tested against local vulnerable instance
Fixes #1507
Type of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake testand I confirm all tests passed locallydocs/folder