JMX (Java Management Extensions): Functions, Console and Security

What Is JMX?

JMX stands for Java Management Extensions. It has been part of Java since Java 5. It lets you look inside a running Java app and control it.

An example: an online shop runs on a Java server and suddenly slows down. Via JMX, the admin sees that memory is almost full and a cache is too big. They clear the cache with one click, without a restart.

Many well-known Java apps and servers use JMX, such as app servers, databases, message systems and search engines built on Java.

How JMX Is Built

• MBeans (managed beans): Java objects that make a resource manageable. They have attributes, such as "number of open connections", and operations, such as "clear cache".
• MBean server: the list inside the app where all MBeans are kept.
• Connectors: they let you reach the MBean server from outside, usually via RMI (remote method invocation).
• Consoles and tools: programs that connect and show the values.

JMX Consoles and Tools

• JConsole: a graphical tool that ships with the Java Development Kit.
• VisualVM: a free tool for monitoring and troubleshooting.
• Web consoles: older application servers such as earlier JBoss versions came with their own JMX Console in the browser.
• HTTP bridges: tools such as Jolokia make JMX reachable over HTTP and JSON. This is handy for monitoring, but it is also an access point that must be protected.
• Monitoring tools: many of them read JMX values on their own and show them in dashboards.

Typical Functions

Monitoring

Memory use, threads, CPU load, garbage collection, connections and the app's own figures.

Management

Changing settings while the app runs, clearing caches, starting and stopping services.

Logging

Changing how much detail goes into logs, for example to collect more for a while to find a fault.

Why JMX Can Be a Security Risk

JMX is meant for admins and gives deep access to the app. That is just what makes it tempting for attackers:

• Remote access without login: if JMX can be reached from the network without a login, attackers can often load their own MBeans and so run any code on the server.
• Unencrypted connections: without TLS, login data and commands can be read along the way.
• Outdated web consoles: old JMX web consoles were often poorly protected. In JBoss, the protection of the JMX Console could be bypassed in 2010 with a trick in the HTTP request (CVE-2010-0738).
• Unsafe deserialization: JMX over RMI reads in Java objects. Mistakes here have led to flaws in the past that let attackers slip in code.
• Too many rights: anyone who only needs to read values should not also be able to run operations.

A well-known real-world example: in 2016, the SamSam ransomware used poorly secured JBoss servers, among other things, as a way into company networks. Read more about exploiting flaws under exploit.

Configuring JMX Securely

• Remote access only when needed: if JMX is only needed locally, keep remote access turned off.
• Limit the network: only make JMX ports reachable from a management network, never from the internet. See network segmentation.
• Require a login: turn it on and use strong, unique login data.
• Encrypt: turn on TLS for all JMX connections.
• Separate rights: grant read access and write access separately. See least privilege.
• Secure HTTP bridges: protect Jolokia or similar endpoints just like JMX itself.
• Stay up to date: update Java, application servers and libraries on a regular basis. See patch management.
• Monitor: log access to JMX and report unusual connections.

Finding Open JMX Access

Companies often do not even know that a JMX port is open somewhere, for example on an old test server. A vulnerability scan or a penetration test shows which admin interfaces can be reached from outside or on the internal network, and whether they are protected.

Conclusion

JMX is a handy tool for watching and controlling Java apps. Because it gives deep access, an open JMX port without protection is a serious risk. If you only open remote access when needed, limit it to a management network, enforce login and TLS and keep Java up to date, you can use JMX safely.