CVE-2015-1830
published 2015-08-19CVE-2015-1830: Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows…
PriorityP261medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
84.41%
99.7th percentile
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| debian | activemq | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcurl -v -X PUT --data "@jetty-realm.properties" http://TARGET:8161/fileserver/..\conf\jetty-realm.properties↗
commandcurl -u 'hacker:hacker' -v -X PUT --data "@cmd.jsp" http://TARGET:8161/fileserver/..\admin\cmd.jsp↗
- →Detect HTTP PUT requests to paths containing the traversal sequence '..\' (backslash) targeting the /fileserver/ endpoint on port 8161, which is the ActiveMQ web console port. ↗
- →Alert on HTTP PUT requests to /fileserver/ that contain '..\ ' (backslash-based directory traversal), as Linux-style '../' traversal is blocked by Jetty but backslash traversal is not. ↗
- →Monitor for JSP file creation in the /admin directory of ActiveMQ's web context, especially files uploaded via HTTP PUT to /fileserver/ traversal paths. ↗
- →Detect HTTP PUT requests to /fileserver/..\conf\jetty-realm.properties, which indicates an attacker attempting to overwrite ActiveMQ credentials for privilege escalation. ↗
- →Flag blob transfer messages specifying an external uploadUrl (jms.blobTransferPolicy.uploadUrl), which can be abused for server-side request forgery even on non-Windows systems. ↗
- →Monitor ActiveMQ web console (port 8161) for authentication using default credentials admin:admin, particularly combined with PUT requests to /fileserver/ paths. ↗
- ·The directory traversal only works on Windows systems where backslash '\' is a path delimiter; Linux deployments are not vulnerable to the file upload vector (though SSRF via uploadUrl may still apply). ↗
- ·Overwriting jetty-realm.properties to set attacker credentials requires a server reboot to take effect, which may limit exploitation in some scenarios. ↗
- ·For Red Hat/JBoss environments, only the standalone version of ActiveMQ shipped with JBoss A-MQ is affected; it is fixed in version 6.2.0. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_debian5.0LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2015-1830: activemq - Directory traversal vulnerability in the fileserver upload/download functionalit...
vendor_debian·2015·CVSS 5.0
CVE-2015-1830 [MEDIUM] CVE-2015-1830: activemq - Directory traversal vulnerability in the fileserver upload/download functionalit...
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
ghsa·2022-05-14
CVE-2015-1830 [MEDIUM] CWE-22 Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
OSV
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
osv·2022-05-14
CVE-2015-1830 [MEDIUM] Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
No detection rules found.
Exploit-DB
Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)
exploitdb·2020-03-09·CVSS 5.0
CVE-2015-1830 [MEDIUM] Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)
Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload',
'Description' => %q{
This module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache
ActiveMQ 5.x before 5.11.2 for Windows.
The module tries to upload a JSP payload to the /admin directory via the traversal
path /fileserver/..\\admin\\ using an HTTP PUT request with the default ActiveMQ
credentials admin:admin (or other credentials provided by the user). It then issues
an HTTP GET request to /admin/.jsp on the target in order to trigger the
payload and obtain a shell.
Exploit-DB
Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
exploitdb·2015-08-17
CVE-2016-3088 Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
---
I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw in the fileserver upload/download functionality.
I have only been able to reproduce this on Windows, i.e. where "\" is a path delimiter.
An attacker could use this flaw to upload arbitrary files to the server, including a JSP shell, leading to remote code execution.
Exploiting Windows systems to achieve RCE The default conf/jetty.xml includes:
Effectively blocking the upload of JSP files into contexts that will allow them to execute.
I imagine there are many ways around this; for my proof of concept I opted to overwrite conf/jetty-realm.properties and set my own credentials:
$ cat jetty-rea
Metasploit
Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload
metasploit·CVSS 5.0
CVE-2015-1830 [MEDIUM] Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload
Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload
This module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache ActiveMQ 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ credentials admin:admin (or other credentials provided by the user). It then issues an HTTP GET request to /admin/.jsp on the target in order to trigger the payload and obtain a shell.
Bugzilla
CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
bugzilla·2016-05-24·CVSS 5.0
CVE-2016-3088 [MEDIUM] CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
Multiple vulnerabilities have been identified in the Apache ActiveMQ Fileserver web application. These are similar to those reported in CVE-2015-1830 and can allow attackers to replace web application files with malicious code and perform remote code execution on the system.
Mitigation:
Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-3088
Bugzilla
CVE-2015-1830 ActiveMQ: Path traversal leading to unauthenticated RCE
bugzilla·2015-08-31·CVSS 5.0
CVE-2015-1830 [MEDIUM] CVE-2015-1830 ActiveMQ: Path traversal leading to unauthenticated RCE
CVE-2015-1830 ActiveMQ: Path traversal leading to unauthenticated RCE
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Discussion:
*** Bug 1258297 has been marked as a duplicate of this bug. ***
---
This only affects the standalone version of ActiveMQ shipped with JBoss A-MQ. It is fixed in version 6.2.0.
Bugzilla
CVE-2015-1830 Path traversal leading to unauthenticated RCE in ActiveMQ
bugzilla·2015-08-31·CVSS 5.0
CVE-2015-1830 [MEDIUM] CVE-2015-1830 Path traversal leading to unauthenticated RCE in ActiveMQ
CVE-2015-1830 Path traversal leading to unauthenticated RCE in ActiveMQ
Description of problem:
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Discussion:
This only affects the standalone version of ActiveMQ shipped with JBoss A-MQ. It is fixed in version 6.2.0.
---
*** This bug has been marked as a duplicate of bug 1258309 ***
http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txthttp://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.htmlhttp://www.securityfocus.com/bid/76452http://www.securitytracker.com/id/1033315http://www.zerodayinitiative.com/advisories/ZDI-15-407http://www.zerodayinitiative.com/advisories/ZDI-15-407/https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3Ehttp://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txthttp://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.htmlhttp://www.securityfocus.com/bid/76452http://www.securitytracker.com/id/1033315http://www.zerodayinitiative.com/advisories/ZDI-15-407http://www.zerodayinitiative.com/advisories/ZDI-15-407/https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
2015-08-19
Published