CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Fileserver web application. By sending a specially crafted HTTP PUT request and an HTTP MOVE request, an attacker could exploit this vulnerability to create an arbitrary file and execute arbitrary code on the system.
Other sources
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.activemq:activemq-clientto a version that resolves this vulnerability.Fixed in 5.14.0 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.14.0 - Configuration
Disable or undeploy the Fileserver web application to prevent HTTP PUT/MOVE file upload and execution if the Fileserver is not required.
Apache ActiveMQ (Fileserver web application) fileserver_enabled = false - Compensating control
Block or restrict HTTP PUT and HTTP MOVE methods to the ActiveMQ Fileserver (for example via a web application firewall, reverse proxy, or network ACL) to prevent remote upload/execution until a fixed version is applied.
Event History
Frequently Asked Questions
What is CVE-2016-3088?
CVE-2016-3088 is a vulnerability in Apache ActiveMQ that allows a remote attacker to execute arbitrary code on the system.
How does CVE-2016-3088 work?
CVE-2016-3088 is caused by an error in the Fileserver web application of Apache ActiveMQ. By sending a specially crafted HTTP PUT request and an HTTP MOVE request, an attacker can exploit this vulnerability to create an arbitrary file and execute arbitrary code.
What is the severity of CVE-2016-3088?
CVE-2016-3088 has a severity rating of 9.8 out of 10, which is considered critical.
What software is affected by CVE-2016-3088?
Apache ActiveMQ versions up to and including 5.13.3 are affected by CVE-2016-3088. IBM Security Directory Suite VA versions up to and including 8.0.1.19 are also affected.
How can CVE-2016-3088 be mitigated?
To mitigate CVE-2016-3088, users should upgrade to a fixed version of Apache ActiveMQ or IBM Security Directory Suite VA.