Apache ActiveMQ Broker exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console, with a default access policy allowing exec operations on all ActiveMQ MBeans. An authenticated attacker can exploit this by sending a specially crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring instantiates all singleton beans before BrokerService validates the configuration, this leads to arbitrary code execution on the broker's JVM through bean factory methods such as Runtime.exec(). This vulnerability affects Apache ActiveMQ Broker versions before 5.19.4 and from 6.0.0 before 6.2.3. The issue is fixed in versions 5.19.4 and 6.2.3. Red Hat advisories confirm that their products are unaffected as the vulnerable components are not included in shipped products.

An authenticated attacker can achieve remote code execution on the Apache ActiveMQ Broker's JVM by exploiting this vulnerability. This allows execution of arbitrary operating system commands, potentially leading to full compromise of the broker, including confidentiality, integrity, and availability impacts. The attacker can bypass configuration validation and load malicious remote Spring XML contexts, resulting in unauthorized code execution. Red Hat notes that their products are unaffected due to exclusion of the vulnerable components in shipped products.

Users should upgrade Apache ActiveMQ Broker to version 5.19.4 or 6.2.3, which contain fixes for this vulnerability. Red Hat products are not affected as the vulnerable components are not included in their shipped products, so no action is required for Red Hat users. No other mitigations are currently available or meet Red Hat's criteria for ease of use and applicability.