ActiveMQ 5.0.0 - 5.11.1 Path traversal leading to unauthenticated RCE Vulnerability

🗓️ 20 Aug 2015 00:00:00Reported by David JormType

zdt🔗 0day.today👁 84 Views

ActiveMQ 5.0.0 - 5.11.1 unauthenticated RCE Vulnerability in Window

Reporter	Title	Published	Views	Family All 28
0day.today	Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution Vulnerabilities	3 Dec 201600:00	–	zdt
0day.today	Apache ActiveMQ 5.11.1 Directory Traversal / Shell Upload Exploit	6 Mar 202000:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Security Directory Integrator is affected by multiple security vulnerabilities	22 Jun 202316:30	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in ActiveMQ 5.2.0 affect IBM Sterling B2B Integrator (CVE-2015-1830, CVE-2014-8110, CVE-2013-3060, CVE-2013-1880, CVE-2013-1879, CVE-2012-6551, CVE-2012-6092, CVE-2010-1587, CVE-2010-1244, CVE-2010-0684)	16 Jun 201819:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Directory Suite is vulnerable to multiple issues	26 Mar 202503:44	–	ibm
Tenable Nessus	Apache ActiveMQ 5.x < 5.11.2 Blob Message Directory Traversal	19 Feb 201600:00	–	nessus
Tenable Nessus	Apache ActiveMQ Blob Message Directory Traversal	21 Aug 201500:00	–	nessus
BDU FSTEC	The vulnerability of the Apache ActiveMQ software platform, which allows attackers to create JSP files in arbitrary directories.	15 Dec 201500:00	–	bdu_fstec
Circl	CVE-2015-1830	17 Aug 201500:00	–	circl

CVE-2015-1830 - Path traversal leading to unauthenticated RCE in ActiveMQ

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache ActiveMQ 5.0.0 - 5.11.1

Description:

There is a directory traversal flaw in the fileserver upload/download functionality used for blob messages.
The attacker can put a jsp file in the admin console and execute shell command from there. It’s only vulnerable in the Windows OS.

Mitigation:

Upgrade to Apache ActiveMQ 5.12.0 or 5.11.2. The workaround in case fileserver is not used and upgrade is not prefereable is to disable that functionality. It can be done by removing (commenting out) the following lines from conf\jetty.xml file

<bean class="org.eclipse.jetty.webapp.WebAppContext">
<property name="contextPath" value="/fileserver" />
<property name="resourceBase" value="${activemq.home}/webapps/fileserver" />
<property name="logUrlOnStart" value="true" />
<property name="parentLoaderPriority" value="true" />
</bean>

Credit:
This issue was discovered by David Jorm from IIX Product Security

#  0day.today [2018-04-04]  #

20 Aug 2015 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.86019