ActiveMQ漏洞( CVE-2016-3088) 验证

注：学习记录 完成文件上传,文件mv

参考学习网址：http://www.lofter.com/tag/CVE-2016-3088

官方描述:http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt

CVE-2016-3088 - ActiveMQ Fileserver web application vulnerabilities锘�
Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache ActiveMQ 5.0.0 - 5.13.x

Description:

Multiple vulnerabilities have been identified in the Apache ActiveMQ Fileserver web application. These are similar to those reported in CVE-2015-1830 and can allow attackers to replace web application files with malicious code and perform remote code execution on the system.

Mitigation:

Fileserver feature will be completely removed starting with 5.14.0 release. Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file

<bean class="org.eclipse.jetty.webapp.WebAppContext">
<property name="contextPath" value="/fileserver" />
<property name="resourceBase" value="${activemq.home}/webapps/fileserver" />
<property name="logUrlOnStart" value="true" />
<property name="parentLoaderPriority" value="true" />
</bean>

Credit:
This issue was discovered by separated reports of Simon Zuckerbraun and Andrea Micalizzi (rgod) of Trend Micro Zero Day Initiative

第一步: 访问 http://192.168.10.4:8161/fileserver/
第二步: 获取部署路径: 使用火狐 重新编辑 使用PUT 重新发送包: http://192.168.10.4:8161/fileserver/a../test
eg:



第三步: 上传文件



第四步: 移动文件位置



上传成功验证输入 http://192.168.10.4:8161/admin/test.jsp 访问