CVE-2020-11998 PoC — Apache ActiveMQ 代码注入漏洞

Source

https://github.com/shoucheng3/apache__activemq_CVE-2020-11998_5-15-12

Associated Vulnerability

Title:Apache ActiveMQ 代码注入漏洞 (CVE-2020-11998)
Description:A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Readme

Welcome to Apache ActiveMQ 
=======================================================================
Apache ActiveMQ is a high performance Apache 2.0 licensed
Message Broker and JMS 1.1 implementation.

Getting Started
===============
To help you get started, try the following links:

Getting Started
- http://activemq.apache.org/version-5-getting-started.html

Building
- http://activemq.apache.org/version-5-getting-started.html#GettingStarted-WindowsSourceInstallation
- http://activemq.apache.org/version-5-getting-started.html#GettingStarted-UnixSourceInstallation

Examples
- http://activemq.apache.org/examples.html

We welcome contributions of all kinds, for details of how you can help
http://activemq.apache.org/contributing.html

Please refer to the website for details of finding the issue tracker, 
email lists, wiki or IRC channel at http://activemq.apache.org/

Please help us make Apache ActiveMQ better - we appreciate any feedback 
you may have.

Enjoy!

Licensing
=======================================================================

   This software is licensed under the terms you may find in the file 
   named "LICENSE" in this directory.

   This distribution includes cryptographic software.  The country in 
   which you currently reside may have restrictions on the import, 
   possession, use, and/or re-export to another country, of 
   encryption software.  BEFORE using any encryption software, please 
   check your country's laws, regulations and policies concerning the
   import, possession, or use, and re-export of encryption software, to 
   see if this is permitted.  See <http://www.wassenaar.org/> for more
   information.

   The U.S. Government Department of Commerce, Bureau of Industry and
   Security (BIS), has classified this software as Export Commodity 
   Control Number (ECCN) 5D002.C.1, which includes information security
   software using or performing cryptographic functions with asymmetric
   algorithms.  The form and manner of this Apache Software Foundation
   distribution makes it eligible for export under the License Exception
   ENC Technology Software Unrestricted (TSU) exception (see the BIS 
   Export Administration Regulations, Section 740.13) for both object 
   code and source code.

   The following provides more details on the included cryptographic
   software:
   
   ActiveMQ supports the use of SSL TCP connections when used with 
   with a JVM supporting the Java Cryptography extensions
   <http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136007.html>.
   ActiveMQ does not include these libraries itself, but is designed to use them.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →