Rapid7 Vulnerability & Exploit Database

Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload

Back to Search

Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload

Disclosed
08/19/2015
Created
03/05/2020

Description

This module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache ActiveMQ 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ credentials admin:admin (or other credentials provided by the user). It then issues an HTTP GET request to /admin/.jsp on the target in order to trigger the payload and obtain a shell.

Author(s)

  • David Jorm
  • Erik Wynter

Platform

Windows

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/apache_activemq_traversal_upload
msf exploit(apache_activemq_traversal_upload) > show targets
    ...targets...
msf exploit(apache_activemq_traversal_upload) > set TARGET < target-id >
msf exploit(apache_activemq_traversal_upload) > show options
    ...show and set options...
msf exploit(apache_activemq_traversal_upload) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;