Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-3v63-f83x-37x4
Advisory ID github_osv/GHSA-3v63-f83x-37x4
Aliases CVE-2015-1830
Summary Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html
https://github.com/apache/activemq
https://github.com/apache/activemq/commit/729c4731574ffffaf58ebefdbaeb3bd19ed1c7b7
https://github.com/apache/activemq/commit/9fd5cb7dfe0fcc431f99d5e14206e0090e72f36b
https://issues.apache.org/jira/browse/AMQ-5754
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
http://www.securityfocus.com/bid/76452
http://www.securitytracker.com/id/1033315
http://www.zerodayinitiative.com/advisories/ZDI-15-407
CVE-2015-1830 https://nvd.nist.gov/vuln/detail/CVE-2015-1830
CVE-2015-1830-ANNOUNCEMENT.TXT http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt
Data source Exploit-DB
Date added Dec. 2, 2016
Description Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
Ransomware campaign use Known
Source publication date Aug. 17, 2015
Exploit type remote
Platform windows
Source update date Dec. 2, 2016
Source URL http://davidjorm.blogspot.fr/2015/08/directory-traversal-leading-to-rce-when.html
Data source Metasploit
Description This module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache ActiveMQ 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ credentials admin:admin (or other credentials provided by the user). It then issues an HTTP GET request to /admin/<payload>.jsp on the target in order to trigger the payload and obtain a shell.
Note 
Stability:
  - crash-safe
SideEffects:
  - artifacts-on-disk
  - ioc-in-logs
Reliability:
  - repeatable-session
Ransomware campaign use Unknown
Source publication date Aug. 19, 2015
Platform Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/http/apache_activemq_traversal_upload.rb

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.