Summary
Apache Artemis and Apache ActiveMQ Artemis contain a missing authentication check in CORE protocol session reattachment. An unauthenticated remote attacker may craft a SESSION_REATTACH packet to take over an existing authenticated session and continue its execution.
Apache Artemis and Apache ActiveMQ Artemis contain a missing authentication check in CORE protocol session reattachment. An unauthenticated remote attacker may craft a SESSION_REATTACH packet to take over an existing authenticated session and continue its execution.
Affected context
The issue occurs in Artemis deployments that expose the CORE protocol and support session reattachment. It becomes risky when an attacker can reach the protocol endpoint and the broker accepts a crafted reattachment request without adequately proving ownership of the existing authenticated session. Affected product lines include Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0.
The issue occurs in Artemis deployments that expose the CORE protocol and support session reattachment. It becomes risky when an attacker can reach the protocol endpoint and the broker accepts a crafted reattachment request without adequately proving ownership of the existing authenticated session. Affected product lines include Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0.
Exploit preconditions
- Attack surface: A network-accessible Apache Artemis CORE protocol endpoint
- Required access: No authentication is required when the vulnerable reattachment path is reachable
- Trigger point: Processing of a crafted CORE protocol SESSION_REATTACH packet
- Why exploitation is possible: The protocol fails to sufficiently authenticate or bind the reattachment request to the original session owner
- Attack surface: A network-accessible Apache Artemis CORE protocol endpoint
- Required access: No authentication is required when the vulnerable reattachment path is reachable
- Trigger point: Processing of a crafted CORE protocol SESSION_REATTACH packet
- Why exploitation is possible: The protocol fails to sufficiently authenticate or bind the reattachment request to the original session owner
Why this happens
The vulnerability is caused by an insufficient authentication check during CORE protocol session reattachment. The broker permits a client to request continuation of an existing authenticated session without reliably verifying that the requester possesses the session's authentication context or other required binding information. This behavior maps to CWE-306: Missing Authentication for Critical Function, because a security-sensitive session-management operation can be reached without adequate authentication.
The vulnerability is caused by an insufficient authentication check during CORE protocol session reattachment. The broker permits a client to request continuation of an existing authenticated session without reliably verifying that the requester possesses the session's authentication context or other required binding information. This behavior maps to CWE-306: Missing Authentication for Critical Function, because a security-sensitive session-management operation can be reached without adequate authentication.
Potential impact
- An attacker may hijack an existing authenticated session
- Unauthorized commands or operations could be performed with the session's privileges
- Broker-managed messages or resources could be accessed or modified
- Confidentiality, integrity, and availability of broker workloads may be affected
- Compromised sessions could enable broader abuse depending on assigned permissions
- An attacker may hijack an existing authenticated session
- Unauthorized commands or operations could be performed with the session's privileges
- Broker-managed messages or resources could be accessed or modified
- Confidentiality, integrity, and availability of broker workloads may be affected
- Compromised sessions could enable broader abuse depending on assigned permissions
General mitigation guidance
Mitigation generally focuses on ensuring that session reattachment is cryptographically or otherwise strongly bound to the original authenticated context.
Common defensive patterns include:
- Require authentication and authorization checks for every session-attachment operation
- Bind reattachment tokens or identifiers to the authenticated principal and connection context
- Reject stale, malformed, duplicated, or unverifiable reattachment requests
- Restrict CORE protocol exposure to trusted networks and authorized clients
- Apply least-privilege permissions to broker users and service identities
- Use secure-by-default protocol and transport configurations that minimize unauthenticated reachability
- Monitor and invalidate suspicious or unexpected session reattachment activity
Mitigation generally focuses on ensuring that session reattachment is cryptographically or otherwise strongly bound to the original authenticated context.
Common defensive patterns include:
- Require authentication and authorization checks for every session-attachment operation
- Bind reattachment tokens or identifiers to the authenticated principal and connection context
- Reject stale, malformed, duplicated, or unverifiable reattachment requests
- Restrict CORE protocol exposure to trusted networks and authorized clients
- Apply least-privilege permissions to broker users and service identities
- Use secure-by-default protocol and transport configurations that minimize unauthenticated reachability
- Monitor and invalidate suspicious or unexpected session reattachment activity
How teams detect issues like this
Organizations can assess this class of issue through:
- Static and protocol-level review of session creation, restoration, and reattachment handlers
- Code review checks confirming authentication and authorization at every state transition
- Tests that attempt session reattachment from a different unauthenticated or unauthorized client context
- Network policy enforcement limiting CORE protocol endpoints to approved sources
- Runtime monitoring for unusual SESSION_REATTACH requests, repeated failures, or unexpected client changes
- Automated security review tools that flag critical operations reachable before principal verification
Organizations can assess this class of issue through:
- Static and protocol-level review of session creation, restoration, and reattachment handlers
- Code review checks confirming authentication and authorization at every state transition
- Tests that attempt session reattachment from a different unauthenticated or unauthorized client context
- Network policy enforcement limiting CORE protocol endpoints to approved sources
- Runtime monitoring for unusual SESSION_REATTACH requests, repeated failures, or unexpected client changes
- Automated security review tools that flag critical operations reachable before principal verification
Sources
| Source | Link |
|---|---|
| lists. | lists.apache.org/ |
| openwall. | openwall.com/ |
| github. | github.com/ |
