SecBoard
Zurück zur CVE-Übersicht

CVE-2026-33227

MEDIUM(4.3)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Risk Signal Score11/100 — NIEDRIG
  • CVSS 4.3 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

4.3

Technische Schwere

Beschreibung

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 5.19.4
  • 6.2.3

Threat-Hunting-Queries

Detect attempts by authenticated users to traverse the classpath via crafted 'key' values during Stomp consumer creation or web console message browsing. This involves monitoring for unusual path constructions or resource loading attempts outside expected directories.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "activemq" and (CommandLine contains "Stomp" or CommandLine contains "Web console") and (CommandLine contains "../" or CommandLine contains "..\\" or CommandLine contains "/../" or CommandLine contains "\\..\\")

Splunk SPL

sourcetype=activemq (source=*activemq-client* OR source=*activemq-broker* OR source=*activemq-all* OR source=*activemq-web*) (Stomp OR "Web console") (key="*../*" OR key="*..\\*")

Sigma

title: ActiveMQ Classpath Traversal Attempt
status: experimental
description: Detects attempts to traverse the classpath in Apache ActiveMQ via crafted 'key' values.
logsource:
  product: activemq
  service: all
detection:
  selection:
    - message|contains: 'Stomp'
    - message|contains: 'Web console'
  keywords:
    - 'key=*../*'
    - 'key=*..\\*'
  condition: selection and keywords
level: medium

Elastic ES|QL

from logs-activemq.*
| where message : "Stomp" or message : "Web console"
| where message : "key=*../*" or message : "key=*..\\*"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*

Referenzen