PT-2016-3434 · Apache · Apache Activemq

Hillary Benson + 1 · Published 2016-05-24 · Updated 2026-04-07 · CVE-2016-3088

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.x through 5.13.x

Description The issue exists due to insufficient input validation in the Fileserver web application. It allows a remote attacker to upload and execute arbitrary files via an HTTP PUT request followed by an HTTP MOVE request. This can be achieved by sending a PUT request to a vulnerable endpoint, such as /fileserver, and then sending a MOVE request to execute the uploaded file.

Recommendations For Apache ActiveMQ versions 5.x through 5.13.x, update to version 5.14.0 or later to resolve the issue. As a temporary workaround, consider disabling the HTTP MOVE method for the Fileserver web application until a patch is available. Restrict access to the Fileserver web application to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

BDU:2022-04782

CVE-2016-3088

GHSA-RXQH-FC23-GXP2

ZDI-16-356

ZDI-16-357

Affected Products

Apache Activemq

References · 42

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_activemq_upload_jsp.rb · Exploit
• 🔥 https://github.com/coffeehb/Some-PoC-oR-ExP/tree/master/ActiveMQExP · Exploit
• 🔥 https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-3088 · Exploit
• 🔥 https://github.com/gsheller/ActiveMQ_putshell-CVE-2016-3088 · Exploit
• 🔥 https://github.com/YutuSec/ActiveMQ_Crack · Exploit
• 🔥 https://github.com/cyberaguiar/CVE-2016-3088 · Exploit
• 🔥 https://github.com/cl4ym0re/CVE-2016-3088 · Exploit
• 🔥 https://exploit-db.com/exploits/42283 · Exploit
• 🔥 https://exploit-db.com/exploits/40857 · Exploit
• https://bdu.fstec.ru/vul/2022-04782 · Security Note
• https://ubuntu.com/security/CVE-2016-3088 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3088 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxqh-fc23-gxp2 · Vendor Advisory
• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-3088 · Vendor Advisory