Apache Apollo Default Login Scanner

Apache Apollo is a high-performance messaging broker designed for reliable distributed messaging in enterprise environments. It is commonly used in finance, telecommunications, and transportation sectors to facilitate asynchronous message delivery and service decoupling. Developers and IT administrators deploy Apache Apollo to ensure stable and efficient message processing across complex infrastructures, making it a critical component for many digital operations.

The vulnerability involves the use of default login credentials in Apache Apollo installations. This arises when administrators fail to change the factory-set username and password during deployment, leaving the system exposed. Attackers can exploit this oversight by attempting common default combinations, such as 'admin/admin' or 'admin/password', to gain unauthorized access to the broker's management interface.

Specifically, the vulnerability is present in the login endpoint of Apache Apollo's web-based administration console. This endpoint accepts credentials via HTTP POST requests, and if default credentials remain unchanged, an attacker can authenticate with minimal effort. The scanner probes this endpoint with a list of known default credentials to determine if the system is vulnerable.

If exploited, an attacker gains administrative privileges over the Apache Apollo broker, allowing them to read, modify, or delete messages, disrupt message routing, and potentially pivot to other systems within the network. This could lead to data breaches, service outages, and compromised integrity of critical business communications, posing a severe risk to organizational operations.