laitimes

ActiveMQ arbitrary file upload vulnerability is reproduced

author:Hetian Cyber Security Laboratory

1. Use a weak password to log in

Visit http://ip:8161/admin/ to enter the admin login page, log in with a weak password, the account and password are admin, and after the login is successful, the verification information will appear in the headers

如: Authorization: Basic YWRtaW46YWRtaW4=

#二. Use the PUT protocol to upload files

Visit any page and capture the packet, and pay attention to the verification information in the headers

ActiveMQ arbitrary file upload vulnerability is reproduced

Change the GET protocol to the PUT protocol and upload the file to the fileserver directory

PUT /fileserver/jsp.jsp
           
ActiveMQ arbitrary file upload vulnerability is reproduced

As shown in the figure above, the status code returned in the response package is 204, that is, the file has been uploaded successfully

However, accessing the file directly in the fileserver directory will not resolve properly

ActiveMQ arbitrary file upload vulnerability is reproduced

#三. Use the MOVE protocol to move the file to a resolvable directory

Continue to modify the request package protocol to MOVE and add Destination to the header

MOVE /fileserver/jsp.jsp
Destination: file:///opt/activemq/webapps/api/jsp.jsp
           
ActiveMQ arbitrary file upload vulnerability is reproduced

Similarly, the response packet returns a status code of 204, which indicates that the file has been successfully moved to the API directory

ActiveMQ arbitrary file upload vulnerability is reproduced

The code is executed successfully