CVE-2020-13932: Apache ActiveMQ Artemis XSS Vulnerability

CVE-2020-13932 Overview

CVE-2020-13932 is a Cross-Site Scripting (XSS) vulnerability affecting Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0. The vulnerability allows attackers to inject malicious JavaScript payloads through specially crafted MQTT packets, using the client-id or topic name fields as injection vectors. When an administrator accesses the admin console, the malicious payload executes within their browser context, potentially enabling session hijacking, credential theft, or unauthorized administrative actions.

Critical Impact
Attackers can execute arbitrary JavaScript in administrator browsers through the Artemis admin console, potentially compromising administrative sessions and enabling further attacks against the messaging infrastructure.

Affected Products

Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0
Admin console diagram plugin
Queue node information section

Discovery Timeline

2020-07-20 - CVE-2020-13932 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-13932

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in the Apache ActiveMQ Artemis admin console, which fails to properly sanitize user-controlled input received through MQTT protocol messages before rendering it in the web interface.

The attack requires network access and user interaction, specifically an administrator viewing the affected admin console pages. The vulnerability allows an attacker to compromise the confidentiality and integrity of the administrator's session, though availability impact is limited.

Root Cause

The root cause of CVE-2020-13932 is insufficient input validation and output encoding in the Apache ActiveMQ Artemis admin console. When MQTT packets are received by the broker, the client-id and topic name fields are stored and later displayed in the admin console's diagram plugin and queue information sections without proper HTML encoding or sanitization. This allows malicious scripts embedded in these fields to execute when rendered in an administrator's browser.

Attack Vector

The attack exploits the MQTT protocol's client-id and topic name fields as XSS payload delivery mechanisms. An attacker sends specially crafted MQTT packets to the ActiveMQ Artemis broker containing JavaScript payloads in these fields. When an administrator accesses the admin console to view queue diagrams or node information, the unsanitized payload is rendered in the browser, executing the malicious script in the context of the authenticated administrative session.

The XSS payload specifically triggers in two locations within the admin console: the diagram plugin visualization and the queue node information section. This provides multiple exploitation opportunities depending on which administrative interface the victim accesses first.

Detection Methods for CVE-2020-13932

Indicators of Compromise

MQTT connection attempts with unusual or script-containing client-id values
Topic names containing HTML tags or JavaScript code patterns
Admin console access logs showing requests with encoded script characters
Browser console errors related to JavaScript execution from unexpected sources

Detection Strategies

Monitor MQTT traffic for client-id and topic name fields containing HTML tags, script elements, or event handlers
Implement web application firewall (WAF) rules to detect and block XSS payloads in MQTT message metadata
Review admin console access logs for suspicious patterns following MQTT connections from untrusted sources
Configure intrusion detection systems to alert on MQTT packets containing common XSS patterns

Monitoring Recommendations

Enable detailed logging for MQTT connections including client-id values
Implement Content Security Policy (CSP) headers on the admin console to mitigate script execution
Set up alerts for admin console access immediately following connections from new or suspicious MQTT clients
Monitor for unusual JavaScript errors or DOM modifications in admin console sessions

How to Mitigate CVE-2020-13932

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis to a version later than 2.13.0 that contains the security fix
Restrict network access to the MQTT port to trusted clients only
Limit admin console access to trusted networks and implement strong authentication
Consider temporarily disabling the diagram plugin if immediate patching is not possible

Patch Information

Apache has addressed this vulnerability in versions after 2.13.0. Organizations should upgrade to the latest stable release of Apache ActiveMQ Artemis. The official security advisory is available from the Apache ActiveMQ Security Advisory. Additional technical discussions regarding the fix can be found in the Apache ActiveMQ Commit Discussion.

Workarounds

Implement network segmentation to prevent untrusted MQTT clients from connecting to the broker
Use a reverse proxy with XSS filtering capabilities in front of the admin console
Disable the admin console diagram plugin through configuration if not required for operations
Apply browser-level XSS protections and ensure administrators use modern browsers with built-in XSS filtering

bash

# Configuration example - Restrict admin console access in broker.xml
# Add the following to limit admin console binding to localhost only
<web bind="http://localhost:8161" path="web">
    <app url="console" war="console.war"/>
</web>