Description
The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Apache ActiveMQ Directory Traversal
auxiliary/scanner/http/apache_activemq_traversal
-
Apache ActiveMQ JSP Files Source Disclosure
auxiliary/scanner/http/apache_activemq_source_disclosure
Exploit-DB 1
- Apache ActiveMQ 5.2/5.3 - Source Code Information Disclosure EDB-33868 · remote · Apr 22, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-web-console | >= 5.0.0, < 5.3.2 | 5.3.2 | GHSA-v2c9-9m8v-8jjm |
References
- https://issues.apache.org/activemq/browse/AMQ-2700
- 20100422 Apache ActiveMQ is prone to source code disclosure vulnerability. mailing-list
- 39567 third-party-advisory
- 39636 vdb-entry
- 20100422 Apache ActiveMQ is prone to source code disclosure vulnerability. mailing-list
- ADV-2010-0979 vdb-entry
- 64020 vdb-entry