Uploaded image for project: 'ActiveMQ'
  1. ActiveMQ
  2. AMQ-3211

JMSXUserId Can be spoofed by client

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.4.2
    • Fix Version/s: 5.5.0
    • Component/s: Broker
    • Labels:
      None

      Description

      It seems the JMSXUserId can be spoofed by client contrary to what http://activemq.apache.org/jmsxuserid.html says.

      My test setup is populateJMSXUserID="true set in a single broker, a JAAS config org.apache.activemq.jaas.TextFileCertificateLoginModule and using mutual auth SSL (i.e., ?needClientAuth=true for transportConnector setup), and a single consumer and producer based on small modifications of the ConsumerTool and ProducerTool examples in the 5.4.2 distro. See attached the changes to the distro package to demonstrate the bug. Just do
      1. run apache-activemq-5.4.2/bin/activemq-admin start
      2. in apache-activemq-5.4.2/example run ant consumer -Durl=ssl://localhost:61617 -Dmax=3 -Dverbose=true
      3. in another shell in apache-activemq-5.4.2/example run ant producer -Durl=ssl://localhost:61617 -Dmax=3 -Dverbose=true
      4. look at the output of the consumer for the properties printed after each received message (the producer spoofs only on even numbered messages)

      When the client does not set the property, then i get the properly authenticated DN as JMSXUserID using message.getStringProperty("JMSXUserID"). However, when the client sets it, i get the value set by the client. The only difference i notice is that in the former case, message.getPropertyNames() does not return JMSXUserID whereas in the spoofed case it does.

      i wonder whether in the context of https://issues.apache.org/jira/browse/QPID-943 or https://issues.apache.org/jira/browse/AMQ-2840 (which interestingly doesn't list JMSXUserID as supported in a comment even though it is?) something got messed up?

        Attachments

        1. JMSXUserID-bug.conf-src.tar.bz2
          34 kB
          Michael Steiner
        2. JMSXUserID-bug.diff
          42 kB
          Michael Steiner

          Issue Links

            Activity

              People

              • Assignee:
                gtully Gary Tully
                Reporter:
                michsteiner Michael Steiner
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: