Apache ActiveMQ Path Traversal Exploit

There is a directory traversal flaw in the fileserver upload/download functionality used for blob messages in Apache ActiveMQ. The vulnerability allows writing files anywhere in the filesystem as long as the user running the process has permissions to do so. It also allows to copy local files to local or remote destinations, the later by means of abusing UNC paths. This module first uses the vulnerability to upload the credentials for the web administration application to a SMB server and parses the credentials. It then uploads a "Java Server Pages" file, which remains accessible only with appropriate credentials. It then uses the previously retrieved credentials to access the page and achieve remote code execution. The upload of content from the server is done using a MOVE HTTP verb against a REST service. Due to its semantics, the file retrieved is also deleted. This module uses the vulnerability to restore the web application passwords file once it's been retrieved. Because something might stop the process at this point, this module is marked as potentially leaving the service unavailable.