Java JMX Agent Insecure Configuration

Document ID : KB000130586
Last Modified Date : 11/04/2019
Show Technical Document Details
Issue:
Security Scan Vulnerability Finding on our CA Catalog servers on port 1099: 
Java JMX Agent Insecure Configuration 

Here is what Tenable says about it: 
Java JMX Agent Insecure Configuration (118039) 

Synopsis 
A remote Java JMX agent is configured without SSL client and password authentication. 

Description 
A Java JMX agent running on the remote host is configured without SSL client and password authentication. An unauthenticated, remote attacker can connect to the JMX agent and monitor and manage the Java application that has enabled the agent. 

Moreover, this insecure configuration could allow the attacker to create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, the attacker could execute arbitrary code on the remote host under the security context of the remote Java VM. 

Solution 
Enable SSL client or password authentication for the JMX agent.
Environment:

SERVICE MANAGEMENT 17.1
Service Catalog 17.1
Resolution:
1)Below article may help to give some background\context for JMX. 
         "https://www.mulesoft.com/tcat/tomcat-jmx
2) Another case reporting a vulnerability on port 1099. Port 1099 is the JMX port of ActiveMQ Broker component used by Catalog. This port is used to allow remote monitoring of ActiveMQ Broker. 
This port 1099 is open by default in order to allow Java monitoring tools to monitor the performance of ActiveMQ Broker. 

The following steps can be followed to close port 1099 and address the vulnerability: 
--------------------------------------------- 
i. Open the file %USMHOME%\view\webapps\usm\WEB-INF\applicationContext.xml in a text editor 

ii. Search for "useJmx" 

iii. The following entry will match the search 

<amq:broker id="amqBroker" brokerName="brkr-#{jmsConfig.brokerName}" dataDirectory="${usm.home}/logs/jms-data" 
systemExitOnShutdown="false" persistent="true" enableStatistics="true" useJmx="true" networkConnectorStartAsync="true" 
start="false"> 

iv. Update the value of "useJmx" property from true to false. For eg: 

<amq:broker id="amqBroker" brokerName="brkr-#{jmsConfig.brokerName}" dataDirectory="${usm.home}/logs/jms-data" 
systemExitOnShutdown="false" persistent="true" enableStatistics="true" useJmx="false" networkConnectorStartAsync="true" 
start="false"> 

v. Restart Catalog windows service 

vi. Run the vulnerable port scan tool and confirm the result. 
---------------------------------------------