CVE-2016-3088
Apache ActiveMQ Improper Input Validation Vulnerability
Description
CVE-2016-3088 is a CRITICAL unrestricted file upload and remote code execution vulnerability in Apache ActiveMQ, carrying a CVSS 3.1 score of 9.8. Classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), the vulnerability exists in the Fileserver web application bundled with ActiveMQ. An unauthenticated remote attacker can upload arbitrary files via an HTTP PUT request and then move them to executable locations via an HTTP MOVE request, achieving code execution on the server. Affected versions include Apache ActiveMQ 5.0.0 through 5.13.x (before 5.14.0). This CVE is listed in CISA's KEV catalog, added February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 94.29% (99.94th percentile) reflects extremely high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | activemq | >= 5.0.0, < 5.14.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt(Vendor Advisory)
- http://rhn.redhat.com/errata/RHSA-2016-2036.html(Third Party Advisory)
- http://www.securitytracker.com/id/1035951(Broken Link, Third Party Advisory, VDB Entry)
- http://www.zerodayinitiative.com/advisories/ZDI-16-356(Third Party Advisory, VDB Entry)
- http://www.zerodayinitiative.com/advisories/ZDI-16-357(Third Party Advisory, VDB Entry)
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E(Issue Tracking, Mailing List)
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E(Mailing List, Vendor Advisory)
- https://www.exploit-db.com/exploits/42283/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2016-3088 is classified under CWE-434 — Unrestricted Upload of File with Dangerous Type. This weakness occurs when a web application allows users to upload files without adequately verifying file type, content, or destination, enabling the upload of executable files such as web shells, scripts, or compiled binaries.
In Apache ActiveMQ, the bundled Fileserver web application was designed for file transfer functionality but lacked proper access controls and file type restrictions. The application accepts HTTP PUT requests to upload files and HTTP MOVE requests to relocate them, without requiring authentication or validating that uploaded content is non-executable. This combination allows an attacker to upload a JSP web shell and move it to the webapps directory where it will be executed by the servlet container.
Impact Analysis
CVE-2016-3088 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with maximum impact across all dimensions.
Confidentiality (High): Arbitrary code execution on the ActiveMQ server grants the attacker access to all message queue data, application configurations, database credentials, and any sensitive information flowing through the messaging system. ActiveMQ often handles inter-service communication containing business-critical and sensitive data.
Integrity (High): An attacker can modify message queues, inject malicious messages into business workflows, alter application configurations, install persistent backdoors, and tamper with the messaging infrastructure. This can have cascading effects on all systems that depend on ActiveMQ for message delivery.
Availability (High): The attacker can shut down the messaging service, corrupt message stores, deploy ransomware, or use the compromised server as a pivot point for further attacks. Disrupting a central message broker typically impacts multiple dependent applications and services.
No authentication required: The attack requires no privileges (PR:N) and no user interaction (UI:N), making it trivially exploitable by anyone with network access to the ActiveMQ Fileserver endpoint.
With an EPSS score of 94.29% (99.94th percentile), exploitation is near-certain for any exposed instance.
Exploit Maturity
CVE-2016-3088 has a very high exploit maturity with publicly available exploit code and confirmed active exploitation.
Public exploits: Exploit code is available on Exploit-DB (42283) demonstrating the PUT + MOVE file upload technique for achieving code execution. The Zero Day Initiative published advisories (ZDI-16-356 and ZDI-16-357) detailing the vulnerability.
KEV listing: CISA added CVE-2016-3088 to the Known Exploited Vulnerabilities catalog on February 10, 2022, confirming active in-the-wild exploitation. The remediation deadline was August 10, 2022.
Ransomware association: CISA's KEV does not indicate a direct ransomware association, but the ease of exploitation and prevalence of ActiveMQ in enterprise environments make it a valuable target.
Attack simplicity: The exploit requires only two HTTP requests — a PUT to upload a JSP web shell and a MOVE to place it in an executable location. This simplicity enables automated scanning and exploitation.
EPSS context: The EPSS score of 94.29% (99.94th percentile) confirms this vulnerability is extensively exploited in the wild.
Remediation
-
Upgrade Apache ActiveMQ to version 5.14.0 or later. The vulnerability is fixed in ActiveMQ 5.14.0, which removes the vulnerable Fileserver web application. Follow the official security advisory for upgrade guidance.
-
Remove or disable the Fileserver web application. If upgrading is not immediately possible, delete the Fileserver web application from the ActiveMQ deployment. Remove the
fileserverdirectory from the webapps folder and remove any Fileserver-related configuration. -
Restrict network access to ActiveMQ web console and APIs. Use firewall rules to limit access to ActiveMQ's web-based interfaces (typically ports 8161 and 61616) to trusted management networks only. Never expose ActiveMQ administrative interfaces to the internet.
-
Enable authentication for all ActiveMQ interfaces. Configure ActiveMQ to require authentication for the web console, REST API, and all broker connections. Change default credentials (admin/admin) and implement strong password policies.
-
Monitor for web shell indicators. Scan the ActiveMQ webapps directory for unauthorized JSP files or other executable content. Configure file integrity monitoring to detect new or modified files in web-accessible directories.
-
Implement network segmentation for message brokers. Place ActiveMQ instances in a dedicated network segment with strict ingress and egress controls. Message brokers should only be accessible from application servers that need to produce or consume messages.
Technical Details
CVE-2016-3088 is an unrestricted file upload vulnerability in the Fileserver web application bundled with Apache ActiveMQ. The vulnerability allows unauthenticated remote code execution through a two-step HTTP request sequence.
Attack vector and prerequisites: The attack is network-based (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). The attacker needs HTTP access to the ActiveMQ Fileserver endpoint, typically accessible on port 8161.
Step 1 — File upload via HTTP PUT: The attacker sends an HTTP PUT request to the Fileserver endpoint (e.g., /fileserver/exploit.txt) with a JSP web shell as the request body. The Fileserver accepts and stores the file without validating its type or content.
Step 2 — File relocation via HTTP MOVE: The attacker sends an HTTP MOVE request to relocate the uploaded file from the Fileserver storage to the ActiveMQ webapps directory (e.g., /admin/exploit.jsp). The MOVE operation does not check permissions or validate the destination.
Code execution: Once the JSP file is in the webapps directory, it is served by the Jetty servlet container embedded in ActiveMQ. Accessing the JSP file via HTTP triggers its execution, providing the attacker with a web shell for arbitrary command execution.
Affected versions: Apache ActiveMQ versions 5.0.0 through 5.13.x. The Fileserver component was removed in version 5.14.0.
CVSS vector analysis: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — trivially exploitable with maximum impact.
Frequently Asked Questions
What is CVE-2016-3088?
CVE-2016-3088 is a critical unrestricted file upload vulnerability in the Apache ActiveMQ Fileserver web application. It allows unauthenticated attackers to upload and execute arbitrary files on the server using two HTTP requests (PUT to upload, MOVE to relocate). The vulnerability carries a CVSS score of 9.8.
Which versions of ActiveMQ are affected?
Apache ActiveMQ versions 5.0.0 through 5.13.x are affected. The Fileserver web application was removed in version 5.14.0, which eliminates the vulnerability entirely. Any ActiveMQ instance prior to 5.14.0 with the Fileserver component accessible over the network is vulnerable.
How do I fix CVE-2016-3088?
Upgrade to Apache ActiveMQ 5.14.0 or later. If immediate upgrade is not possible, remove the Fileserver web application from the webapps directory. Restrict network access to ActiveMQ's web interfaces, enable authentication, and change default credentials.
How severe is CVE-2016-3088?
CVE-2016-3088 is rated CRITICAL with a CVSS score of 9.8. The EPSS score of 94.29% places it in the 99.94th percentile for exploitation probability. The attack requires only two simple HTTP requests with no authentication, making automated exploitation trivial. CISA confirmed active exploitation through its KEV listing.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.