Exploiting Jolokia for Remote Code Execution: A Cybersecurity Analysis of CVE-2023-50780 in Apache ActiveMQ Artemis

Căciulescu, Alexandru Răzvan; Bădănoiu, Matei; Rughiniș, Răzvan; Țurcanu, Dinu

doi:10.3390/computers15060367

Abstract

Java middleware platforms expose powerful management functions through HTTP-accessible interfaces such as Jolokia. This article discusses the analysis of CVE-2023-50780 in Apache ActiveMQ Artemis by framing the vulnerability as a management-plane state-transition problem rather than as a set of isolated exploit recipes. We analyze three remote-code-execution paths that combine Jolokia-accessible MBeans with Log4J2 configuration mutability, Artemis filesystem and deployment semantics, broker or web-server restart behavior, and, in one vector, the Java DiagnosticCommand interface. The study defines a formal attacker model; separates demonstrated preconditions from deployment-dependent assumptions; compares the three vectors across required privileges, network dependencies, writable artifacts, execution triggers, reliability, detection opportunities, and mitigations; and evaluates defensive controls at the level of the exploit stage they interrupt. The paper also clarifies the responsible-disclosure context and reduces operational payload detail in favor of defender-oriented evidence, validation tables, and architectural analysis. The resulting contribution is a reproducible but bounded case study of how legitimate administrative operations can compose into code execution when management interfaces are exposed without sufficient privilege separation, MBean restriction, filesystem hardening, and upgrade controls.

Keywords:

Apache ActiveMQ Artemis; Jolokia; JMX; Log4J2; management-plane security; remote code execution; vulnerability analysis; middleware security

1. Introduction

Java middleware platforms are rarely composed of a single security boundary. A broker such as Apache ActiveMQ Artemis includes messaging protocols, administrative web interfaces, embedded web-server functionality, logging subsystems, runtime diagnostic facilities, and Java Management Extensions (JMX). Jolokia makes this management layer reachable through HTTP. This design is operationally useful, but it also means that the effective attack surface of the broker is defined by the composition of management operations rather than by the messaging protocol alone [1,2,3,4,5,6].

This article analyzes CVE-2023-50780 in Apache ActiveMQ Artemis as a management-plane vulnerability. The central risk is not a single unsafe function in isolation. Instead, remote code execution becomes possible when an attacker who can invoke Jolokia-exposed MBeans can transform legitimate administrative operations into attacker-controlled state transitions: writing configuration text, changing the Log4J configuration source, overwriting files that are later consumed by the broker or embedded Jetty server, or loading a JVM agent through DiagnosticCommand.

The paper treats the three RCE paths as comparable architectural patterns with explicit preconditions, trigger mechanisms, network assumptions, and mitigations. Operational payloads are minimized in the main text and retained only as bounded reproducibility material where necessary.

1.1. Contributions

A formal attacker model and attack-surface model for Jolokia-exposed Artemis management operations.
A comparative taxonomy of three CVE-2023-50780 RCE vectors: broker.xml overwrite, WAR overwrite with embedded Jetty restart, and JAR loading.
A root-cause analysis separating the roles of Jolokia exposure, Log4J2 configuration mutability, filesystem write primitives, broker restart semantics, embedded Jetty deployment behavior, and DiagnosticCommand availability.
A mitigation–validation matrix that maps defensive controls to the specific exploit stage they interrupt and identifies residual risk.
A responsible-disclosure and dual-use framing that distinguishes reproducibility from operational weaponization.

1.2. Scope and Claim Boundaries

The experiments were performed on Ubuntu 22.04 and 24.04, OpenJDK 17, and Apache ActiveMQ Artemis 2.27.1. The public advisory identifies Apache ActiveMQ Artemis versions before 2.29.0 as affected. We therefore use that advisory as the version boundary, while treating operating-system, JVM, and deployment-specific behavior as empirical limits of the present study.

2. Background and Related Work

JMX provides a standard model for observing and controlling Java applications. Jolokia exposes that model over HTTP and JSON, enabling browser-based and scriptable management operations [1,2,3]. In a secure deployment, these operations remain restricted to trusted administrative users and networks. In a weak deployment, they become a remote interface to powerful runtime components.

Log4J2 is relevant here not because of JNDI or deserialization [7,8], but because its runtime configuration can define appenders, file targets, layouts, and configuration sources. When the corresponding MBeans are exposed, an attacker may be able to replace or redirect logging configuration and thereby transform a logging subsystem into a file-write primitive [4,5].

Apache ActiveMQ Artemis [9] combines this management surface with broker configuration files, an embedded web console based on Jetty, and JVM diagnostic facilities. Prior work on Java exploitation, dependency composition, exposed administrative services, and broker security shows that exploitability often emerges from the interaction among components rather than from the presence of a vulnerable library alone [10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28]. A prior case study of CVE-2022-41678 in Apache ActiveMQ Classic demonstrated that Jolokia-exposed Log4J MBeans can serve as a sufficient basis for remote code execution [29]. Furthermore, prior Jolokia-specific exploitation research and tooling [30,31] also illustrate how management-plane operations can be composed into code execution. CVE-2023-50780 is therefore best understood as a concrete case of compositional management-plane risk.

3. Threat Model and Attack Surface

The attacker is assumed to have HTTP reachability to the Jolokia endpoint exposed by the Artemis web console. In the baseline scenario, this access is authenticated with administrative credentials. In misconfigured deployments using anonymous access, the authentication requirement may be absent. The attacker is not assumed to have an operating-system shell, direct filesystem access, local Java process access, or privileges outside the management plane at the start of the attack.

The security objective is to prevent management-plane access from becoming arbitrary code execution. The attacker objective is to compose reachable management operations into a sequence that writes attacker-controlled content to a security-relevant path and then causes the broker, web server, or JVM to execute that content.

Figure 1 summarizes the relevant management-plane components and boundaries, and Table 1 presents the attacker model and environmental assumptions.

Figure 1. Management-plane attack surface for CVE-2023-50780. The figure emphasizes the composition of Jolokia, MBeans, filesystem artifacts, and runtime triggers rather than individual payload syntax.

Table 1. Attacker model and environmental assumptions.

4. Methodology

The methodology separates four activities: component enumeration, state-transition construction, controlled validation, and mitigation analysis. Component enumeration identifies reachable MBeans and operations. State-transition construction models whether a reachable operation can mutate a file, configuration source, deployment artifact, or runtime loader state. Controlled validation tests whether the transition sequence results in code execution under a specific environment. The validation leveraged publicly available tooling for Jolokia-based Log4J exploitation [32] and JVM agent loading [33]. Mitigation analysis tests which defensive control interrupts which transition.

Baseline Environment

The baseline environment was Ubuntu 22.04 and 24.04 LTS, OpenJDK 17, and Apache ActiveMQ Artemis 2.27.1, with Jolokia exposed at the Artemis console endpoint. This environment demonstrates practical exploitability but should not be treated as sufficient by itself for claims about all vulnerable versions or all deployment profiles.

5. Results: Three Management-Plane RCE Vectors

The three RCE vectors are presented as state-transition sequences. This avoids overemphasizing operational payload syntax while preserving the security-relevant mechanism and reproducibility logic.

5.1. Vector 1: broker.xml Overwrite and Broker Restart

The first vector uses Log4J2 configuration mutability to overwrite the Artemis broker.xml configuration file [34] with attacker-controlled content. The security-relevant transition is: Jolokia invocation of a Log4J2 configuration operation → attacker-controlled write to broker.xml → broker restart or induced failover followed by restart → evaluation of the modified network-check command during startup.

This vector demonstrates that configuration files used by the broker are security-sensitive execution inputs. Its main limitation is trigger dependence: code execution occurs only when the entire Java process restarts.

5.2. Vector 2: WAR Overwrite and Embedded Jetty Restart

The second vector targets the embedded web-server deployment path. The attacker uses the Log4J2 configuration source mechanism to load a properties-format configuration and overwrite an existing Artemis WAR file. Execution occurs when the embedded Jetty server is restarted through the Artemis broker MBean, causing the modified WAR to be redeployed. The WAR payload leverages servlet-based command execution techniques [35] and standard payload generation tooling [36].

This vector differs materially from the others because the implementation loads the malicious Log4J properties file from a remote FTP URI. This outbound dependency is not intrinsic. Vector 3 demonstrates local staging without outbound retrieval.

5.3. Vector 3: Local Double-Write JAR and JVM Agent Loading

The third vector addresses two hardening assumptions: restricted outbound connectivity and protected WAR file ownership. It uses a double-write pattern in which an XML Log4J2 configuration [37] first writes a local properties-format configuration, and a subsequent ConfigLocationUri update loads that local file to write a JAR into a writable path. The attacker then invokes DiagnosticCommand.jvmtiAgentLoad through Jolokia to load the agent into the running JVM [38,39].

This vector shows that egress filtering alone is insufficient. Blocking outbound connections can prevent remote configuration retrieval but does not by itself prevent local staging if Log4J2 configuration mutation and DiagnosticCommand invocation remain reachable. See a comparison of the three vectors in Table 2.

Table 2. Comparison of the three RCE vectors.

6. Root-Cause Analysis

The exploitability of CVE-2023-50780 results from individually legitimate features that, when chained by an attacker, can produce malicious behavior, including arbitrary file writes and indirect RCE, as seen in Figure 2.

Figure 2. Root-cause decomposition of the management-plane RCE condition.

The first root cause is HTTP reachability of JMX semantics. Jolokia translates HTTP requests into management operations that were originally designed for trusted administrative contexts. The second is excessive authority in exposed MBeans: Log4J2 configuration methods can influence file outputs, Artemis broker operations can restart components, and DiagnosticCommand can load runtime agents.

The third root cause is trigger availability. A file write alone is not RCE; execution requires a broker restart, web-server redeploy, or JVM loader invocation. Finally, deployment hardening determines which paths remain viable. File ownership separation may block WAR overwrite while leaving temporary-file and DiagnosticCommand paths available; egress filtering may block remote configuration retrieval while leaving local double-write staging available.

7. Mitigation Validation

Mitigations should be evaluated according to the stage they interrupt. Table 3 therefore distinguishes complete prevention from partial disruption and residual risk. This framing is stronger than listing general best practices because it tells operators why a control works and where it is insufficient alone.

Table 3. Mitigation coverage by exploit stage and residual risk.

8. Responsible Disclosure and Dual-Use Considerations

Because the study concerns practical RCE paths, the presentation of technical details must be balanced against misuse risk. The vulnerability was responsibly disclosed to the Apache ActiveMQ project and fixed in Artemis 2.29.0 [6].

The dual-use value of this article lies in showing how individually benign management operations can compose into harmful transition chains, while giving defenders stage-specific points for prevention, validation, and detection.

9. Discussion

The broader implication of CVE-2023-50780 is that management-plane security requires least privilege at the level of operations, not merely authentication at the level of endpoints. An authenticated administrator interface may still be unsafe if it exposes operations that can write arbitrary files, redirect configuration sources, restart executable components, or load code into the JVM without additional policy checks.

Mitigations such as egress filtering interrupt remote configuration retrieval but do not prevent local double-write staging. File ownership separation protects WAR artifacts but does not remove the risk of writable temporary locations. Authentication reduces exposure but does not constrain the management operations that can be called post-authentication. Effective defense therefore requires layered controls: upgrade applications to secure versions, Jolokia restrictions, MBean minimization, filesystem separation, runtime diagnostic hardening, egress controls, integrity monitoring, and alerting on suspicious MBean operations.

Appendix A presents the controlled reproducibility material used to support the analysis of CVE-2023-50780 in Apache ActiveMQ Artemis. Future work will develop automated heuristics that enumerate exposed MBeans, classify operations by security-relevant effects, and detect dangerous transition chains before they are exploitable in production.

10. Limitations

The main limitation is experimental breadth. The experiments demonstrate exploitability in a subset of potential existing environments, but additional Artemis versions, patched releases, Java runtimes, and hardened deployment profiles should be tested before making broader empirical claims.

A second limitation is that the work focuses on initial code execution, not the full post-exploitation lifecycle. Lateral movement, privilege escalation, persistence, and data exfiltration are outside the present scope.

A third limitation is that some mitigation claims are mechanism-based and require deployment-specific validation, especially patched-version behavior, MBean restriction policies, and filesystem-permission variants.

11. Conclusions

This study analyzes CVE-2023-50780 as a management-plane vulnerability in Apache ActiveMQ Artemis. The three RCE vectors differ in trigger mechanism, network assumptions, and hardening sensitivity, but they share a common architectural pattern: Jolokia-exposed MBeans allow attacker-controlled state transitions that convert configuration mutability, filesystem writes, deployment behavior, or JVM diagnostic capabilities into code execution.

The strongest defensive conclusion is that management interfaces must be treated as security boundaries with operation-level least privilege. Upgrading to the fixed Artemis release is essential, but durable risk reduction also requires restricting Jolokia exposure, minimizing exposed MBeans, separating writable configuration from executable artifacts, disabling unnecessary diagnostic loaders, filtering egress, and monitoring management-plane state changes. The case therefore contributes not only a bounded reconstruction of CVE-2023-50780, but also a framework for analyzing similar risks in Java middleware management architectures.

Author Contributions

Conceptualization, A.R.C., M.B., R.R. and D.Ț.; Methodology, A.R.C., M.B. and R.R.; Software, A.R.C. and M.B.; Validation, A.R.C., M.B. and R.R.; Formal analysis, A.R.C. and M.B.; Investigation, A.R.C. and M.B.; Resources, M.B. and D.Ț.; Data curation, A.R.C. and M.B.; Writing—original draft, A.R.C., M.B., R.R. and D.Ț.; Writing—review and editing, A.R.C., M.B., R.R. and D.Ț.; Visualization, A.R.C. and M.B.; Supervision, R.R. and D.Ț.; Project administration, R.R. and D.Ț. All authors have read and agreed to the published version of the manuscript.

Funding

This research received no external funding.

Data Availability Statement

The data supporting the findings of this study are available from the corresponding author upon reasonable request.

Conflicts of Interest

The authors declare no conflicts of interest.

Abbreviations

The following abbreviations are used in this manuscript:

AMQP	Advanced Message Queuing Protocol
API	Application Programming Interface
CVE	Common Vulnerabilities and Exposures
FTP	File Transfer Protocol
HTTP	Hypertext Transfer Protocol
HTTPS	Hypertext Transfer Protocol Secure
JAR	Java Archive
JDK	Java Development Kit
JMX	Java Management Extensions
JNDI	Java Naming and Directory Interface
JSON	JavaScript Object Notation
JVM	Java Virtual Machine
JVMTI	Java Virtual Machine Tool Interface
Log4J2	Apache Log4j 2
LTS	Long-Term Support
MBean	Managed Bean
OS	Operating System
RCE	Remote Code Execution
REST	Representational State Transfer
URI	Uniform Resource Identifier
WAR	Web Application Archive
XML	Extensible Markup Language

Appendix A. Reproducibility Boundaries and Validation Evidence

This appendix reports the controlled reproducibility material used to support the analysis of CVE-2023-50780 in Apache ActiveMQ Artemis. The material is organized around experimentally observed state transitions rather than operational exploit recipes. Executable payload strings, authentication headers, complete malicious configuration files, reverse-shell commands, and automated exploitation recipes are not included.

Appendix A.1. Laboratory Environment

The experiments were conducted in a controlled laboratory environment (see Table A1). The environment demonstrates practical exploitability under the stated assumptions and is not an exhaustive test of every Artemis release, Java runtime, operating system, or hardening profile.

Table A1. Laboratory environment and role in the analysis.

Appendix A.2. Management Objects and Security-Relevant Operations

The analysis focuses on management operations that can be composed into security-relevant state transitions (see Table A2). The relevant operations are ordinary administrative mechanisms in isolation; the risk appears when they are reachable through Jolokia and can be chained with writable artifacts or execution triggers.

Table A2. Management objects and security relevance.

Appendix A.3. State-Transition Validation Model

Each vector was evaluated as a sequence of management-plane state transitions. A transition (see Table A3) is security-relevant when a reachable management operation changes a file, configuration source, deployment artifact, process state, or runtime-loader state in a way that contributes to code execution.

Table A3. State-transition validation model.

Appendix A.4. Sanitized Validation Summary of the Three Vectors

Table A4 summarizes the three RCE vectors using the same order and terminology as the main text. The table records preconditions, state transitions, observed results, and claim boundaries without publishing reusable payloads. Requests and artifacts are represented by their functional role, such as management invocation, configuration mutation, remote configuration retrieval, local staging, and execution evidence.

Table A4. Sanitized validation summary of the three RCE vectors.

Appendix B. Defensive Controls, Detection Artifacts, and Disclosure Scope

This appendix supports the mitigation and dual-use analysis by mapping controls to the stage of the transition chain that they interrupt. The controls are presented as stage-specific risk reductions rather than as interchangeable best practices.

Appendix B.1. Mitigation Coverage by Transition Stage

Table A5 maps mitigation controls to stages, risks, and residual risk.

Table A5. Mitigation controls mapped to transition stages and residual risk.

Control	Stage Interrupted	Vectors Affected	Effect	Residual Risk
Upgrade to Apache ActiveMQ Artemis 2.29.0 or later	Underlying vulnerable exposure according to the public advisory.	All vectors within the advisory scope.	Primary remediation.	Management interfaces still require hardening and monitoring.
Restrict Jolokia to trusted administrative networks	Reachability.	All vectors.	Prevents remote entry through Jolokia when correctly enforced.	Compromised trusted hosts or administrative credentials remain high impact.
Disable anonymous Jolokia access	Authentication requirement.	All vectors.	Prevents unauthenticated exploitation.	Authenticated misuse remains possible if dangerous operations are still exposed.
Restrict Log4J2 configuration operations	Configuration mutation and file-write primitive.	broker.xml overwrite, WAR overwrite, and local JAR staging.	Interrupts the write primitive used by the demonstrated chains.	Other writable management operations remain audit targets.
Restrict DiagnosticCommand	JVM-agent loading trigger.	Local double-write JAR vector.	Blocks the demonstrated final trigger for JVM-agent loading.	Does not block broker.xml or WAR consumption triggers.
Separate filesystem ownership and write permissions	Writable artifact stage.	broker.xml and WAR overwrite vectors, depending on path ownership.	Blocks or disrupts writes to protected artifacts.	Writable temporary paths may remain available for local staging.
Filter outbound egress	Remote configuration retrieval.	Remote-loading WAR variant.	Blocks remote configuration retrieval.	Does not block setConfigText paths or local double-write staging.
Monitor WAR integrity	Deployment artifact modification.	WAR overwrite vector.	Detects or blocks unauthorized WAR modification depending on enforcement.	Monitoring alone is not preventive without alert handling or blocking.
Audit Jolokia writes and MBean invocations	Detection and investigation.	All vectors.	Detects suspicious state transitions.	Effectiveness depends on log completeness, alerting, and handling time.

Appendix B.2. Detection-Oriented Artifacts

The same state-transition view can be used defensively (see Table A6). The observable patterns below correspond to management-plane changes, artifact mutations, and execution triggers rather than to payload content.

Table A6. Detection artifacts for defender-oriented validation.

Appendix B.3. Responsible Disclosure and Dual-Use Scope

The vulnerability was responsibly disclosed to the Apache ActiveMQ project and fixed in Apache ActiveMQ Artemis 2.29.0. The appendix therefore limits reproducibility to the level of state-transition evidence. This level of detail is sufficient to evaluate the architectural finding, reproduce the behavior in a controlled laboratory, and reason about mitigations, while avoiding publication of reusable payloads, credentials, reverse-shell material, and automation recipes.

References

Oracle Corporation. Java Management Extensions (JMX) Technology. Available online: https://www.oracle.com/java/technologies/javase/javamanagement.html (accessed on 27 April 2026).
Huss, R. Jolokia—Overview and Introduction. Available online: https://jolokia.org/ (accessed on 27 April 2026).
Block, A. Jolokia JVM Monitoring in OpenShift. Red Hat Developer Blog. 30 March 2016. Available online: https://developers.redhat.com/blog/2016/03/30/jolokia-jvm-monitoring-in-openshift (accessed on 27 April 2026).
Apache Software Foundation. Apache Log4j 2—Introduction. Available online: https://logging.apache.org/log4j/2.x/ (accessed on 27 April 2026).
Apache Software Foundation. Apache Log4j 2.x Manual. Available online: https://logging.apache.org/log4j/2.x/manual/ (accessed on 27 April 2026).
Apache Software Foundation. CVE-2023-50780: Apache ActiveMQ Artemis. Available online: https://www.cve.org/CVERecord?id=CVE-2023-50780 (accessed on 27 April 2026).
National Institute of Standards and Technology (NIST). CVE-2021-44228 Detail. National Vulnerability Database, 2021. Available online: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (accessed on 27 April 2026).
Cybersecurity and Infrastructure Security Agency (CISA). Log4Shell (CVE-2021-44228) Guidance, 2021. Available online: https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance (accessed on 27 April 2026).
Apache Software Foundation. Apache ActiveMQ Artemis—Overview. Available online: https://activemq.apache.org/components/artemis/ (accessed on 27 April 2026).
Sayar, I.; Bartel, A.; Bodden, E.; Le Traon, Y. An In-Depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities. ACM Trans. Softw. Eng. Methodol. 2023, 32, 1–45. [Google Scholar] [CrossRef] [Scilit]
Bartel, A.; Klein, J.; Le Traon, Y. MUSTI: Dynamic Prevention of Invalid Object Initialization Attacks. IEEE Trans. Inf. Forensics Secur. 2019, 14, 2167–2178. [Google Scholar] [CrossRef] [Scilit]
Shcherbakov, M.; Balliu, M. SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web. In Proceedings of the Network and Distributed System Security Symposium (NDSS), Online, 21–25 February 2021. [Google Scholar] [CrossRef] [Scilit]
Meng, N.; Nagy, S.; Yao, D.D.; Zhuang, W.; Arango-Argoty, G. Secure Coding Practices in Java: Challenges and Vulnerabilities. In Proceedings of the 40th International Conference on Software Engineering (ICSE), Gothenburg, Sweden, 27 May–3 June 2018; Association for Computing Machinery: New York, NY, USA, 2018; pp. 372–383. [Google Scholar] [CrossRef] [Scilit]
Mousavi, Z.; Islam, C.; Babar, M.A.; Abuadbba, A.; Moore, K. Detecting Misuse of Security APIs: A Systematic Review. ACM Comput. Surv. 2025, 57, 1–39. [Google Scholar] [CrossRef] [Scilit]
Zhao, L.; Chen, S.; Xu, Z.; Liu, C.; Zhang, L.; Wu, J.; Sun, J.; Liu, Y. Software Composition Analysis for Vulnerability Detection: An Empirical Study on Java Projects. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), San Francisco, CA, USA, 3–9 December 2023. [Google Scholar] [CrossRef] [Scilit]
Pour, M.S.; Nader, C.; Friday, K.; Bou-Harb, E. A Comprehensive Survey of Recent Internet Measurement Techniques for Cyber Security. Comput. Secur. 2023, 128, 103123. [Google Scholar] [CrossRef] [Scilit]
Everson, D.; Cheng, L. A Survey on Network Attack Surface Mapping. Digit. Threat. Res. Pract. 2024, 5, 1–25. [Google Scholar] [CrossRef] [Scilit]
Dahlmanns, M.; Lohmöller, J.; Fink, I.B.; Pennekamp, J.; Wehrle, K.; Henze, M. Easing the Conscience with OPC UA: An Internet-Wide Study on Insecure Deployments. In Proceedings of the ACM Internet Measurement Conference, Virtual, 27–29 October 2020; Association for Computing Machinery: New York, NY, USA, 2020; pp. 101–110. [Google Scholar] [CrossRef] [Scilit]
Dahlmanns, M.; Lohmöller, J.; Pennekamp, J.; Bodenhausen, J.; Wehrle, K.; Henze, M. Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things. In Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS), Virtual, 30 May–3 June 2022; Association for Computing Machinery: New York, NY, USA, 2022; pp. 252–266. [Google Scholar] [CrossRef] [Scilit]
Babenko, T.; Kolesnikova, K.; Abramkina, O.; Vitulyova, Y. Automated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment. Computers 2025, 14, 430. [Google Scholar] [CrossRef] [Scilit]
Kalra, G.S. Threat Analysis of an Enterprise Messaging System. Netw. Secur. 2014, 2014, 5–9. [Google Scholar] [CrossRef] [Scilit]
McAteer, I.N.; Malik, M.I.; Baig, Z.; Hannay, P. Security Vulnerabilities and Cyber Threat Analysis of the AMQP Protocol for the Internet of Things. In Proceedings of the 15th Australian Information Security Management Conference, Perth, Australia, 5–6 December 2017; Edith Cowan University: Perth, Australia, 2017; pp. 70–80. [Google Scholar] [CrossRef]
Baouya, A.; Hamid, B.; Gürgen, L.; Bensalem, S. Rigorous Security Analysis of RabbitMQ Broker with Concurrent Stochastic Games. Internet Things 2024, 26, 101161. [Google Scholar] [CrossRef] [Scilit]
Abioye, T.E.; Arogundade, O.T.; Misra, S.; Adesemowo, K.; Damaševičius, R. Cloud-Based Business Process Security Risk Management: A Systematic Review, Taxonomy, and Future Directions. Computers 2021, 10, 160. [Google Scholar] [CrossRef] [Scilit]
Wang, M.; Sun, Y.; Sun, H.; Zhang, B. Security Issues on Industrial Internet of Things: Overview and Challenges. Computers 2023, 12, 256. [Google Scholar] [CrossRef] [Scilit]
Obaidat, M.A.; Obeidat, S.; Holst, J.; Al Hayajneh, A.; Brown, J. A Comprehensive and Systematic Survey on the Internet of Things: Security and Privacy Challenges, Security Frameworks, Enabling Technologies, Threats, Vulnerabilities and Countermeasures. Computers 2020, 9, 44. [Google Scholar] [CrossRef] [Scilit]
Everson, D.; Cheng, L.; Zhang, Z. Log4shell: Redefining the Web Attack Surface. In Proceedings of the Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb), San Diego, CA, USA, 3 March 2022. [Google Scholar] [CrossRef] [Scilit]
Hiesgen, R.; Nawrocki, M.; Kristoff, J.; Waehlisch, M. The Log4j Incident: A Comprehensive Measurement Study of a Critical Vulnerability. IEEE Trans. Netw. Serv. Manag. 2024, 21, 5921–5934. [Google Scholar] [CrossRef] [Scilit]
Caciulescu, A.R.; Badanoiu, M.; Rughinis, R.; Turcanu, D. Remote Code Execution via Log4J MBeans: Case Study of Apache ActiveMQ (CVE-2022-41678). Computers 2025, 14, 355. [Google Scholar] [CrossRef] [Scilit]
Laluka. Jolokia Exploitation Toolkit. GitHub Repository. Available online: https://github.com/laluka/jolokia-exploitation-toolkit (accessed on 27 April 2026).
Pyn3rd. A New Way of Jolokia Remote Code Execution. 15 November 2022. Available online: https://pyn3rd.github.io/2022/11/15/A-New-Way-of-Jolokia-Remote-Code-Execution/ (accessed on 27 April 2026).
Badanoiu, M. Log4Jolokia. GitHub Repository. Available online: https://github.com/mbadanoiu/Log4Jolokia (accessed on 27 April 2026).
Badanoiu, M. jvmtiAgentLoad-Exploit. GitHub Repository. Available online: https://github.com/mbadanoiu/jvmtiAgentLoad-Exploit (accessed on 27 April 2026).
Apache Software Foundation. ActiveMQ Artemis Documentation: Configuration Reference. Available online: https://activemq.apache.org/components/artemis/documentation/latest/configuration-index.html (accessed on 27 April 2026).
Badanoiu, M. Java-Servlets-Shell. GitHub Repository. Available online: https://github.com/mbadanoiu/Java-Servlets-Shell (accessed on 27 April 2026).
Offensive Security. MSFvenom. Available online: https://www.offsec.com/metasploit-unleashed/msfvenom/ (accessed on 27 April 2026).
Bray, T.; Paoli, J.; Sperberg-McQueen, C.M.; Maler, E.; Yergeau, F.; Cowan, J. Extensible Markup Language (XML) 1.0 (Fifth Edition). W3C Recommendation. 26 November 2008. Available online: https://www.w3.org/TR/xml/ (accessed on 27 April 2026).
Ain, Q.U.; Ahmed, S.; Zafar, A.; Mehmood, M.A.; Waheed, A. Analysis of Hotspot Methods in JVM for Best-Effort Run-Time Parallelization. In Proceedings of the International Conference on Computing and Electronic Engineering (IC4E 2018), San Diego, CA, USA, 11–13 January 2018; Association for Computing Machinery: New York, NY, USA, 2018; pp. 60–63. [Google Scholar] [CrossRef] [Scilit]
Oracle Corporation. JVM Tool Interface (JVMTI), Java SE 8. Available online: https://docs.oracle.com/javase/8/docs/platform/jvmti/jvmti.html (accessed on 27 April 2026).

Figure 1. Management-plane attack surface for CVE-2023-50780. The figure emphasizes the composition of Jolokia, MBeans, filesystem artifacts, and runtime triggers rather than individual payload syntax.

Figure 2. Root-cause decomposition of the management-plane RCE condition.

Table 1. Attacker model and environmental assumptions.

Table 2. Comparison of the three RCE vectors.

Table 3. Mitigation coverage by exploit stage and residual risk.

Control	broker.xml Overwrite	WAR Overwrite	JAR Load	Residual Risk
Upgrade to Apache ActiveMQ Artemis 2.29.0 or later	Blocks vulnerable exposure	Blocks vulnerable exposure	Blocks vulnerable exposure	Must still harden management access and monitor exposed endpoints.
Disable anonymous Jolokia	Prevents unauthenticated exploitation	Prevents unauthenticated exploitation	Prevents unauthenticated exploitation	Does not reduce risk from authenticated misuse.
Restrict Jolokia to trusted networks and administrators	Blocks remote entry point via Jolokia if correctly enforced	Blocks remote entry point via Jolokia if correctly enforced	Blocks remote entry point via Jolokia if correctly enforced	Compromised administrator credentials remain high impact.
MBean allowlisting/denylisting for Log4J2 configuration operations	Blocks file read and write primitives	Blocks file read and write primitives	Blocks file read and write primitives	Other dangerous writable MBeans should still be audited.
Restrict DiagnosticCommand	No direct effect	No direct effect	Blocks final execution trigger	Other execution triggers may exist in different deployments.
Filesystem ownership separation for static files	Blocks or disrupts broker.xml overwrite	Blocks or disrupts WAR overwrite	No direct effect as temp paths remain writable	Does not prevent JAR tampering.
Egress filtering	No direct effect for setConfigText path	Blocks remote ConfigLocationUri retrieval variant. No direct effect if local double-write is used	No direct effect for local double-write path	Local staging may bypass egress-only defenses.
WAR integrity monitoring	No direct effect	Detects or blocks unauthorized WAR modification	No direct effect	Useful as detection, not sufficient as sole preventive control.
Audit Jolokia requests and MBean writes	Detects suspicious state transitions	Detects suspicious state transitions	Detects suspicious state transitions	Detection depends on logging completeness and alert response.

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Article Metrics

Citations

Article Access Statistics

Journal Statistics

Multiple requests from the same IP address are counted as one view.

Item	Setting	Role in the Analysis	Boundary of the Claim
Operating system	Ubuntu Linux 22.04 and 24.04 LTS, 64 bit	Baseline host environment for the controlled experiments.	The reported experiments do not establish identical behavior on every operating system.
Java runtime	OpenJDK 17	Runtime used to observe Artemis, Log4J2, Jolokia, and DiagnosticCommand behavior.	Other Java runtimes are deployment variants unless directly tested.
Target application	Apache ActiveMQ Artemis 2.27.1	Vulnerable Artemis version used for direct validation.	Broader affected-version claims rely on the public vulnerability boundary and are not presented as an exhaustive version test.
Management entry point	Jolokia endpoint exposed through the Artemis web console	Remote management interface through which MBean operations were invoked.	Exploitability depends on endpoint reachability, authentication, and exposed MBeans.
Baseline access model	Authenticated administrative Jolokia access	Access level used in the demonstrated experiments.	Anonymous Jolokia access is a higher-exposure misconfiguration and is not required by the demonstrated baseline.
Network egress	Available for the remote-loading WAR variant; not required for the local double-write JAR vector	Separates vectors that depend on remote configuration retrieval from vectors that stage artifacts locally.	Egress filtering affects remote-loading variants but does not by itself remove all local-staging risk.

Component	Relevant Capability	Security Relevance in the Transition Chain
Log4J2 MBeans	Runtime configuration operations, including configuration text updates and configuration source changes.	Creates a configuration mutation and file-write primitive when the corresponding operations are exposed.
Artemis broker MBeans	Broker management operations, including component restart or failover behavior.	Provides trigger conditions that cause modified broker or web-server artifacts to be consumed.
DiagnosticCommand MBean	Dynamic loading of JVM agents through jvmtiAgentLoad where available.	Provides the final runtime loading trigger for the local JAR vector.
Filesystem artifacts	Broker configuration files, existing WAR files, and writable local staging paths.	Represent the persistent or temporary objects modified before execution is triggered.

Stage	Validation Question	Evidence Retained in the Article
Reachability	Can the relevant Jolokia endpoint and MBean operation be reached under the stated access model?	MBean presence and successful invocation result, with executable request details omitted.
Mutation	Can the reachable operation alter a security-relevant file, configuration source, deployment artifact, or staging path?	Before/after artifact class, parser behavior, and affected path category.
Trigger	What event causes the modified artifact or staged object to be consumed?	Broker restart, embedded web-server restart, or JVM-agent loading event.
Execution observation	Was controlled execution observed in the laboratory?	Benign marker output or process-side confirmation rather than interactive shell material.
Control interruption	Which defensive control interrupts the transition chain?	Control-to-stage mapping and residual-risk statement.

Vector	Preconditions	State Transition	Observed Result	Claim Boundary
broker.xml overwrite and broker restart	Jolokia reachability; relevant Log4J2 configuration operation exposed; Artemis process can write the broker configuration path; restart or failover path exists.	A management operation causes Log4J2 to write attacker-controlled configuration content to the broker configuration file; later restart causes the broker to evaluate the modified network-check command field.	Controlled command execution was observed after restart-triggered consumption of the modified configuration.	This vector depends on full application restart or an equivalent trigger.
WAR overwrite and embedded Jetty restart	Jolokia reachability; Log4J2 configuration source mutation exposed; Artemis process can write an existing WAR artifact; embedded web-server restart operation exposed.	ConfigLocationUri loads a properties-format configuration and writes content into an existing WAR; embedded Jetty restart causes redeployment.	The modified WAR was consumed after embedded web-server restart and produced controlled command-execution evidence.	The demonstrated remote-loading variant depends on outbound retrieval and is affected by egress filtering.
Local double-write JAR and JVM-agent loading	Jolokia reachability; Log4J2 configuration mutation exposed; writable local path exists; DiagnosticCommand.jvmtiAgentLoad is available.	An XML configuration writes a local properties configuration; the local properties configuration writes a JAR to a writable path; DiagnosticCommand loads the JAR into the JVM.	The JVM-agent load returned a successful status and produced benign controlled-output evidence.	This vector does not require outbound connectivity but depends on DiagnosticCommand availability and a writable staging path.

Detection Focus	Observable Pattern	Rationale
Log4J2 runtime configuration mutation	Unexpected setConfigText invocations or ConfigLocationUri changes through Jolokia.	These operations establish the configuration-redirection or file-write primitive.
Writes to broker configuration or deployment artifacts	Modification time, hash, ownership, or content changes for broker.xml, existing WAR files, or writable staging directories.	These changes indicate transition from management invocation to persistent or staged artifact mutation.
Embedded web-server restart	Unexpected restartEmbeddedWebServer invocation or Jetty redeployment event.	This is the trigger stage for WAR consumption.
Broker restart or failover event	Unexpected restart or failover sequence near broker configuration modification.	This is the trigger stage for broker.xml consumption.
DiagnosticCommand invocation	jvmtiAgentLoad calls exposed through management-plane audit logs.	This is the final trigger for the local JAR vector.
Outbound retrieval from configuration parser	Unexpected HTTP/FTP retrieval associated with runtime configuration loading.	This distinguishes the remote-loading WAR variant from local staging.

Assumption	Baseline in Experiments	Security Significance
Jolokia reachability	HTTP endpoint available through the Artemis web console	Defines the remote attack entry point.
Authentication	Authenticated administrative Jolokia access; anonymous mode discussed as misconfiguration	Determines whether exploitation requires credentials.
Log4J2 MBeans	Runtime configuration operations reachable	Creates the configuration replacement and file-write primitive.
Broker MBeans	Artemis broker management operations reachable	Provides restart or failover triggers.
DiagnosticCommand MBean	Available in the JVM configuration used for testing	Enables the JAR + JVMTI vector when not restricted.
Filesystem permissions	Artemis process can write selected configuration, WAR, or temporary paths	Determines which files can be modified.
Egress	Required by the remote loading variant of Log4J configs	Controls whether remote ConfigLocationUri loading is available.

Vector	Required MBeans	Network Assumption	Writable Artifact	Trigger	Primary Limitation
broker.xml overwrite	Log4J2; optionally Artemis broker forceFailover	No outbound connection required for the described setConfigText vector	broker.xml or equivalent broker configuration path	Full broker restart	Execution depends on full application restart.
WAR overwrite	Log4J2; Artemis broker restartEmbeddedWebServer	Vector presents optional remote loading variant that requires outbound FTP/HTTP. Variations may be performed to remove the need for outbound connections.	Existing Artemis WAR files	Embedded Jetty restart	Blocked by WAR ownership separation or depending on attack vector egress controls.
JAR load	Log4J2; DiagnosticCommand	No outbound connection required for local double-write path	Writable local JAR path, such as temporary storage	jvmtiAgentLoad	Blocked if DiagnosticCommand is unavailable or restricted.