{"id":885,"date":"2026-04-22T01:02:51","date_gmt":"2026-04-21T18:02:51","guid":{"rendered":"https:\/\/vncybers.vn\/lo-hong-13-nam-trong-apache-activemq-bi-khai-thac-cisa-dua-vao-danh-sach-khan\/"},"modified":"2026-04-23T21:26:46","modified_gmt":"2026-04-23T14:26:46","slug":"lo-hong-13-nam-trong-apache-activemq-bi-khai-thac-cisa-dua-vao-danh-sach-khan","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/lo-hong-13-nam-trong-apache-activemq-bi-khai-thac-cisa-dua-vao-danh-sach-khan\/","title":{"rendered":"L\u1ed7 h\u1ed5ng 13 n\u0103m trong Apache ActiveMQ b\u1ecb khai th\u00e1c: CISA \u0111\u01b0a v\u00e0o danh s\u00e1ch kh\u1ea9n"},"content":{"rendered":"<figure class=\"wp-block-image aligncenter\"><img decoding=\"async\" src=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/activemq-cve-2026-34197.jpg\" alt=\"L\u1ed7 h\u1ed5ng CVE-2026-34197 trong Apache ActiveMQ b\u1ecb khai th\u00e1c\" style=\"max-width:800px;width:100%;height:auto\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng Hoa K\u1ef3 (<strong>CISA<\/strong>) v\u1eeba b\u1ed5 sung <strong>CVE-2026-34197<\/strong> v\u00e0o danh m\u1ee5c <em>Known Exploited Vulnerabilities (KEV)<\/em>, t\u1ee9c l\u00e0 l\u1ed7 h\u1ed5ng \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf v\u00e0 b\u1eaft bu\u1ed9c c\u00e1c c\u01a1 quan li\u00ean bang M\u1ef9 ph\u1ea3i v\u00e1 trong th\u1eddi h\u1ea1n quy \u0111\u1ecbnh. \u0110\u00e2y l\u00e0 l\u1ed7 h\u1ed5ng <strong>Remote Code Execution (RCE)<\/strong> trong <strong>Apache ActiveMQ Classic<\/strong>, ph\u1ea7n m\u1ec1m message broker ph\u1ed5 bi\u1ebfn trong h\u1ec7 th\u1ed1ng doanh nghi\u1ec7p, v\u00e0 \u0111i\u1ec1u \u0111\u00e1ng kinh ng\u1ea1c l\u00e0 n\u00f3 \u0111\u00e3 <strong>\u1ea9n m\u00ecnh su\u1ed1t 13 n\u0103m<\/strong> m\u00e0 kh\u00f4ng ai ph\u00e1t hi\u1ec7n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Jolokia API, c\u00e1nh c\u1eeda h\u1eadu b\u1ecb b\u1ecf qu\u00ean 13 n\u0103m<\/h2>\n\n\n<p class=\"wp-block-paragraph\">Theo nh\u00e0 nghi\u00ean c\u1ee9u Naveen Sunkavally t\u1eeb Horizon3.ai, l\u1ed7 h\u1ed5ng xu\u1ea5t ph\u00e1t t\u1eeb <strong>Jolokia API<\/strong>, m\u1ed9t API qu\u1ea3n l\u00fd t\u00edch h\u1ee3p s\u1eb5n trong ActiveMQ. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 g\u1eedi l\u1ec7nh qu\u1ea3n l\u00fd qua Jolokia \u0111\u1ec3 \u0111\u00e1nh l\u1eeba broker <strong>t\u1ea3i m\u1ed9t file c\u1ea5u h\u00ecnh t\u1eeb xa<\/strong> do ch\u00fang ki\u1ec3m so\u00e1t, d\u1eabn \u0111\u1ebfn th\u1ef1c thi l\u1ec7nh OS t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">M\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m t\u0103ng th\u00eam khi k\u1ebft h\u1ee3p v\u1edbi <strong>CVE-2024-32114<\/strong>, m\u1ed9t l\u1ed7 h\u1ed5ng c\u0169 khi\u1ebfn Jolokia API b\u1ecb l\u1ed9 ra ngo\u00e0i <em>kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c<\/em> tr\u00ean c\u00e1c phi\u00ean b\u1ea3n ActiveMQ 6.0.0 \u0111\u1ebfn 6.1.1. Hai l\u1ed7 h\u1ed5ng k\u1ebft h\u1ee3p = <strong>unauthenticated RCE<\/strong>: k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n t\u00e0i kho\u1ea3n, chi\u1ebfm server ngay l\u1eadp t\u1ee9c.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0110ang b\u1ecb khai th\u00e1c h\u00e0ng lo\u1ea1t<\/h2>\n\n\n<p class=\"wp-block-paragraph\">Threat intelligence cho th\u1ea5y c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng \u0111ang <strong>t\u00edch c\u1ef1c qu\u00e9t (scan) t\u00ecm endpoint Jolokia b\u1ecb l\u1ed9<\/strong> tr\u00ean Internet. Apache ActiveMQ \u0111\u01b0\u1ee3c d\u00f9ng r\u1ed9ng r\u00e3i trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p \u0111\u1ec3 x\u1eed l\u00fd h\u00e0ng \u0111\u1ee3i tin nh\u1eafn (message queue), c\u00f3 m\u1eb7t trong nhi\u1ec1u h\u1ec7 th\u1ed1ng t\u00e0i ch\u00ednh, logistics, v\u00e0 \u1ee9ng d\u1ee5ng Java enterprise. Vi\u1ec7c m\u00e1y ch\u1ee7 ActiveMQ b\u1ecb chi\u1ebfm c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>C\u00e0i ransomware m\u00e3 h\u00f3a to\u00e0n b\u1ed9 d\u1eef li\u1ec7u<\/li><li>Di chuy\u1ec3n ngang sang c\u00e1c h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 kh\u00e1c<\/li><li>\u0110\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m trong h\u00e0ng \u0111\u1ee3i tin nh\u1eafn<\/li><li>C\u00e0i backdoor duy tr\u00ec quy\u1ec1n truy c\u1eadp l\u00e2u d\u00e0i<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">H\u00e0nh \u0111\u1ed9ng c\u1ea7n l\u00e0m ngay<\/h2>\n\n\n<ol class=\"wp-block-list\"><li><strong>C\u1eadp nh\u1eadt Apache ActiveMQ<\/strong> l\u00ean phi\u00ean b\u1ea3n \u0111\u00e3 v\u00e1 CVE-2026-34197 ngay l\u1eadp t\u1ee9c<\/li><li><strong>Ki\u1ec3m tra xem Jolokia API c\u00f3 b\u1ecb l\u1ed9 ra Internet kh\u00f4ng<\/strong>, ch\u1eb7n truy c\u1eadp t\u1eeb b\u00ean ngo\u00e0i v\u00e0o port qu\u1ea3n l\u00fd (8161, 61616)<\/li><li><strong>Ki\u1ec3m tra log<\/strong> t\u00ecm d\u1ea5u hi\u1ec7u truy c\u1eadp b\u1ea5t th\u01b0\u1eddng v\u00e0o <code>\/api\/jolokia<\/code><\/li><li><strong>\u00c1p d\u1ee5ng x\u00e1c th\u1ef1c m\u1ea1nh<\/strong> cho to\u00e0n b\u1ed9 API qu\u1ea3n l\u00fd, kh\u00f4ng \u0111\u1ec3 endpoint m\u1edf m\u1eb7c \u0111\u1ecbnh<\/li><li>N\u1ebfu ch\u01b0a th\u1ec3 v\u00e1 ngay: <strong>c\u00f4 l\u1eadp m\u00e1y ch\u1ee7 ActiveMQ<\/strong> kh\u1ecfi Internet, ch\u1ec9 cho ph\u00e9p truy c\u1eadp n\u1ed9i b\u1ed9<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb: The Hacker News, Horizon3.ai, CISA KEV Catalog, Vulert, C\u1eadp nh\u1eadt ng\u00e0y 22\/4\/2026<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>CVE-2026-34197 , l\u1ed7 h\u1ed5ng RCE \u1ea9n 13 n\u0103m trong Apache ActiveMQ qua Jolokia API , \u0111\u00e3 b\u1ecb khai th\u00e1c trong th\u1ef1c t\u1ebf v\u00e0 \u0111\u01b0\u1ee3c CISA \u0111\u01b0a v\u00e0o danh m\u1ee5c KEV b\u1eaft bu\u1ed9c v\u00e1 kh\u1ea9n c\u1ea5p. H\u00e0ng ngh\u00ecn doanh nghi\u1ec7p \u0111ang d\u00f9ng ActiveMQ c\u00f3 nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n to\u00e0n b\u1ed9 m\u00e1y ch\u1ee7.<\/p>","protected":false},"author":2,"featured_media":882,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[33,37,35,34,36],"class_list":["post-885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-apache","tag-cisa","tag-cve","tag-lo-hong-bao-mat","tag-rce"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=885"}],"version-history":[{"count":7,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/885\/revisions"}],"predecessor-version":[{"id":1083,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/885\/revisions\/1083"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/882"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}