{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2016-3088/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2016-3088/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2016-3088/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2016-3088/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2016-3088/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2016-3088"},"sightings":{"href":"/api/v1/sightings/cve-2016-3088"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2016/CVE-2016-3088.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2016-3088\n\ninfo:\n  name: Apache ActiveMQ Fileserver - Arbitrary File Write\n  author: fq_hsu\n  severity: critical\n  description: Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application.\n  impact: |\n    An attacker can write arbitrary files on the server, potentially leading to remote code execution.\n  remediation: |\n    Upgrade to Apache ActiveMQ version 5.14.0 or later to fix the vulnerability.\n  reference:\n    - https://www.exploit-db.com/exploits/40857\n    - https://medium.com/@knownsec404team/analysis-of-apache-activemq-remote-code-execution-vulnerability-cve-2016-3088-575f80924f30\n    - http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt\n    - https://nvd.nist.gov/vuln/detail/CVE-2016-3088\n    - http://rhn.redhat.com/errata/RHSA-2016-2036.html\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2016-3088\n    cwe-id: CWE-20\n    epss-score: 0.98518\n    epss-percentile: 0.99919\n    cpe: cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: apache\n    product: activemq\n    shodan-query:\n      - cpe:\"cpe:2.3:a:apache:activemq\"\n      - product:\"activemq openwire transport\"\n  tags: cve2016,cve,fileupload,kev,edb,apache,activemq,intrusive,vkev,vuln\nvariables:\n  rand1: '{{rand_int(11111111, 99999999)}}'\n\nhttp:\n  - raw:\n      - |\n        PUT /fileserver/{{randstr}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n        {{rand1}}\n      - |\n        GET /fileserver/{{randstr}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1==204\"\n          - \"status_code_2==200\"\n          - \"contains((body_2), '{{rand1}}')\"\n        condition: and\n# digest: 4a0a0047304502205ebe3cac03f343fe69969be45ef8d38cd18b89e946a0c6d1b3d67ccc371fc46a022100c4333102503fbcc652ba237b8d5f42e928b6b731889147de0666fbde763151a5:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2016-3088"}