CVE-2015-1830

Related Files

Apache ActiveMQ 5.11.1 Directory Traversal / Shell Upload

Posted Mar 5, 2020

Authored by David Jorm, Erik Wynter | Site metasploit.com

This Metasploit module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache ActiveMQ versions 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\\admin\\ using an HTTP PUT request with the default ActiveMQ credentials admin:admin (or other credentials provided by the user). It then issues an HTTP GET request to /admin/<payload>.jsp on the target in order to trigger the payload and obtain a shell.

tags | exploit, web, shell

systems | windows

advisories | CVE-2015-1830

SHA-256 | 962139239272b0ab745f8a302505e5c8a4403aa9a95316d97e92c5946f3bd92f

Download | Favorite | View

Apache ActiveMQ 5.11.1 / 5.13.2 Directory Traversal / Command Execution

Posted Dec 3, 2016

Authored by David Jorm

Apache ActiveMQ versions 5.11.1 and 5.13.2 suffer from command execution and directory traversal vulnerabilities.

tags | exploit, vulnerability, file inclusion

advisories | CVE-2015-1830, CVE-2016-3088

SHA-256 | af92593cd167e432ea1a2a76dc455bd4c971961c37ff8849eb0989167654bf38

Download | Favorite | View