CVE-2022-35278

What it actually does

Stored cross-site scripting in the web console allows an unauthenticated attacker to persist malicious HTML or JavaScript inside address or queue names; when an administrator views the console the script executes in the victim's browser context, enabling content injection or open redirect.

Why it matters to the business

Administrators using the management console can be tricked into visiting attacker-controlled sites or executing arbitrary scripts, risking credential theft, session hijacking, or further internal pivoting with no user interaction required beyond normal console use.

How an attack unfolds

An attacker creates or renames an address or queue containing crafted HTML or JavaScript. When any authenticated console user later browses the address or queue list, the browser renders and executes the payload, which can display fake login forms or redirect the session to a malicious domain.

How to fix it

Upgrade Apache ActiveMQ Artemis to version 2.24.0 or later (commit 897d9beaefbdd4d84b7735c9ffafc82264c11c56). If immediate upgrade is not possible, restrict web-console access to trusted networks and require strong authentication.

How to confirm the fix worked

Confirm the running broker reports version 2.24.0 or newer; attempt to create an address containing a benign script tag and verify it is rendered as text rather than executed in the console.

Typical attack path

1. Identify an unauthenticated or low-privileged path to create or update an address/queue name
2. Craft a queue or address name containing executable HTML or a redirect payload
3. Submit the malicious name through the management interface or protocol
4. Wait for an administrator to load the web console address/queue view
5. Capture credentials, session tokens, or perform open redirect to an attacker site

How to detect it

Review web-console access logs and broker audit logs for creation or renaming of addresses and queues containing HTML tags or javascript: URIs; correlate with subsequent unexpected outbound redirects or form submissions from administrator browsers.

What your security team should do

• Schedule upgrade to 2.24.0 within the next maintenance window
• Restrict web-console exposure to management networks only
• Enable audit logging on address and queue creation events
• Monitor EPSS trend and re-evaluate if exploitation maturity increases