CVE-2016-3088

CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign.

What to do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise.