{
  "Name": "ActiveMQ Deserialization Vulnerability (CVE-2015-5254)",
  "Description": "Apache ActiveMQ version 5.x before the 5.13.0 security vulnerability, the vulnerability caused by the program does not limit the classes that can be serialized in the proxy. Remote attacker can make a special serialized Java Message Service (JMS) ObjectMessage objects exploit this vulnerability to execute arbitrary code.",
  "Product": "Apache-ActiveMQ",
  "Homepage": "http://activemq.apache.org/",
  "DisclosureDate": "2015-07-01",
  "Author": "LubyRuffy",
  "FofaQuery": "protocol=activemq",
  "Level": "3",
  "Impact": "Remote attacker can use this default to control the server.",
  "Recommendation": "Upgrade to Apache ActiveMQ 5.13.0. Additionally if you're using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at: http://activemq.apache.org/objectmessage.html",
  "References": [
    "https://nvd.nist.gov/vuln/detail/CVE-2015-5254",
    "https://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt",
    "https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet",
    "http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt",
    "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.html",
    "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.html",
    "http://rhn.redhat.com/errata/RHSA-2016-0489.html",
    "http://rhn.redhat.com/errata/RHSA-2016-2035.html",
    "http://rhn.redhat.com/errata/RHSA-2016-2036.html",
    "http://www.debian.org/security/2016/dsa-3524",
    "http://www.openwall.com/lists/oss-security/2015/12/08/6",
    "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
    "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
    "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
    "https://issues.apache.org/jira/browse/AMQ-6013",
    "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5254"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "Name": "cmd",
      "Type": "input",
      "Value": "whoami"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": [
    "rce"
  ],
  "CVEIDs": [
    "CVE-2015-5254"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["Apache-ActiveMQ"],
    "Support": null,
    "Service": ["activemq"],
    "System": null,
    "Hardware": null
  }
}