Intel

CVE-2016-3088

Improper Input Validation in Apache ActiveMQ

criticalKEV: actively exploitedPoCEPSS 99%

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Source: OSVCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-3088 grants unauthenticated remote attackers full code execution on the broker host via a simple two-step HTTP sequence — no credentials, no prior access required. The EPSS score of 98.52 % (99.9th percentile) reflects the high availability of working exploit code and the large installed base of unpatched instances; CISA KEV inclusion confirms real-world exploitation. Organisations running ActiveMQ as production middleware — particularly in NIS2/KRITIS sectors such as energy, transport, or healthcare — face a high-impact scenario where broker compromise can cascade into message manipulation, lateral movement, or full infrastructure takeover. Treat this as critical regardless of the absence of a CISA ransomware flag: patch or disable the Fileserver within 24 hours, and validate compensating controls are in place before that window closes.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Upgrade Apache ActiveMQ to version 5.14.0 or later. All 5.x releases prior to 5.14.0 are affected — verify the exact artifact version in the Apache release archive (activemq.apache.org/download-archives).
  • Disable the Fileserver web application: If an immediate upgrade is not feasible, remove the Fileserver webapp from the ActiveMQ deployment or comment out its handler entry in conf/jetty.xml. In 5.14.0 the Fileserver is disabled by default — replicate that posture manually on older installs.
  • Restrict network access to port 8161 and 61616: Firewall-ACL the ActiveMQ admin console (8161/TCP) and broker port (61616/TCP) to authorised management networks only. No direct internet exposure.
  • Inspect upload directories immediately: Check ${ACTIVEMQ_HOME}/webapps/fileserver/ for unknown files (JSP, WAR, SH, EXE, PHP). Preserve suspicious files for forensics before removal.
  • Rotate credentials: Reset ActiveMQ admin passwords (conf/jetty-realm.properties) and all service accounts with broker access.

Runbook · Step 2

Mitigation layers

  • WAF / reverse proxy: Block HTTP methods PUT and MOVE on the /fileserver/* path at the network edge. Nginx example: limit_except GET POST { deny all; } scoped to the fileserver location block.
  • Network segmentation: Place ActiveMQ brokers in a dedicated broker VLAN; restrict east-west traffic to explicitly enumerated producer/consumer hosts. No direct reachability from DMZ or internet segments.
  • IPS signature: Suricata/Snort rule targeting an HTTP PUT followed by MOVE to the same path on port 8161 — example: alert http any any -> $ACTIVEMQ_SERVERS 8161 (msg:"CVE-2016-3088 ActiveMQ Fileserver PUT+MOVE RCE"; flow:to_server,established; content:"PUT"; http_method; pcre:"/^\/fileserver\//Ui"; sid:2016308801; rev:1;).
  • Least-privilege process account: Run the ActiveMQ service under a dedicated, non-privileged OS account with no interactive shell; mount the upload directory with the noexec flag where the filesystem supports it.
  • File-extension whitelist: If the Fileserver must remain operational, enforce server-side validation to an allowlist of safe extensions (e.g. .xml, .properties) and strip execute permissions from the upload directory.

Runbook · Step 3

Detection rules

  • Web/proxy access logs: A PUT to /fileserver/<path> followed by a MOVE to the same path from the same client within 60 seconds — SPL: index=proxy method IN (PUT,MOVE) uri_path="/fileserver/*" | transaction clientip maxspan=60s | where mvcount(method)>1.
  • Filesystem monitoring (auditd / Sysmon): New files created under ${ACTIVEMQ_HOME}/webapps/fileserver/ with extensions .jsp, .war, .sh, .py, .php — Sysmon EID 11 (FileCreate) with TargetFilename matching *\fileserver\*.jsp.
  • Process ancestry (EDR): Child processes spawned by activemq.jar / java.exe with suspicious arguments — Sigma shape: ParentImage|endswith: 'java.exe' AND CommandLine|contains: ['cmd','bash','wget','curl','powershell'].
  • Network telemetry (Zeek / Suricata): Outbound connections from the ActiveMQ host to external IPs on non-standard ports following a PUT/MOVE event — indicator of post-exploitation activity (reverse shell, C2 beacon).
  • auditd / Windows Event Log: File creation or modification inside the webapps directory by the ActiveMQ service process — auditd key activemq_webroot, syscalls open/creat, path containing fileserver.

Metrics

Severity
critical
Priority score
161.27
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
98.5 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-05-14 01:14 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • maven

    org.apache.activemq:activemq-client5.0.0

  • maven

    org.apache.activemq:activemq-client5.10.0

  • maven

    org.apache.activemq:activemq-client5.10.1

  • maven

    org.apache.activemq:activemq-client5.10.2

  • maven

    org.apache.activemq:activemq-client5.11.0

  • maven

    org.apache.activemq:activemq-client5.11.1

  • maven

    org.apache.activemq:activemq-client5.11.2

  • maven

    org.apache.activemq:activemq-client5.11.3

  • maven

    org.apache.activemq:activemq-client5.11.4

  • maven

    org.apache.activemq:activemq-client5.12.0

  • maven

    org.apache.activemq:activemq-client5.12.1

  • maven

    org.apache.activemq:activemq-client5.12.2

  • maven

    org.apache.activemq:activemq-client5.12.3

  • maven

    org.apache.activemq:activemq-client5.13.0

  • maven

    org.apache.activemq:activemq-client5.13.1

  • maven

    org.apache.activemq:activemq-client5.13.2

  • maven

    org.apache.activemq:activemq-client5.13.3

  • maven

    org.apache.activemq:activemq-client5.13.4

  • maven

    org.apache.activemq:activemq-client5.13.5

  • maven

    org.apache.activemq:activemq-client5.8.0

  • maven

    org.apache.activemq:activemq-client5.9.0

  • maven

    org.apache.activemq:activemq-client5.9.1

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-3088