Remote File Upload Vulnerability in Apache ActiveMQ - CVE-2016-3088
Summary
CVE-2016-3088: The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Affects activemq across 2 version ranges.
< 5.14.0+dfsg-1
>= 38fcc0ce0178d4a6870aa4f68e2b565c1ad0aa6f, < 71cbc652835e8b6b9d17b7a28fc998fce4840a9b
Fixed in 5.14.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications through various messaging protocols. It is widely used for its reliability and scalability in enterprise environments. However, versions prior to 5.14.0 are susceptible to a critical vulnerability that allows unauthorized file uploads, potentially leading to remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3088, exists in the Fileserver web application of Apache ActiveMQ versions 5.x before 5.14.0. It allows remote attackers to upload and execute arbitrary files by sending an HTTP PUT request followed by an HTTP MOVE request. This flaw can lead to severe consequences, including unauthorized access to sensitive data and complete system compromise, as attackers can execute malicious code on the server.
How To Fix
Minimum fixed version
5.14.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing the following workaround: Disable the Fileserver feature in ActiveMQ by modifying the configuration file (activemq.xml) to prevent unauthorized file uploads. This can be done by commenting out or removing the relevant section that enables the Fileserver.
Conclusion
CVE-2016-3088 represents a significant security risk for users of Apache ActiveMQ versions prior to 5.14.0. It is crucial to upgrade to the latest version to mitigate this vulnerability and protect your systems from potential exploitation.
See every vulnerability recorded for activemq →
FAQ
CVE-2016-3088 is a vulnerability in Apache ActiveMQ that allows remote attackers to upload and execute arbitrary files.
All versions of Apache ActiveMQ 5.x prior to 5.14.0 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and remote code execution on the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The CVSS score of CVE-2016-3088 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
