Permissions, Privileges, and Access Controls in ActiveMQ Artemis - CVE-2025-27427
Published: March 31, 2025
Vulnerability details
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to application does not properly impose security restrictions. A remote user with "createDurableQueue" or "createNonDurableQueue" permission on an address can augment the routing-type supported by that address even if said user doesn't have the "createAddress" permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.