Trustwave SpiderLabs Security Advisory TWSL2018-008: Cross-Site Scripting (XSS) Vulnerability in Apache ActiveMQ Published: 08/24/2018 Version: 1.0 Vendor: Apache Product: ActiveMQ Version affected: prior to 5.15.5 Product description: Apache ActiveMQ ™ is the most popular and powerful open source messaging and Integration Patterns server. Finding 1: Cross-Site Scripting (XSS) in QueueFilter Parameter Credit: Bruno Oliveira of Trustwave CVE: CVE-2018-8006 CWE: CWE-79 The QueueFilter parameter from the queues.jsp file is not proper sanitized and allows client-side injection code (Cross-Site Scripting). PoC: http://localhost:8161/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%22SpiderLabs%22)%3c%2fscript%3eqb68 Remediation Steps: Upgrade to ActiveMQ 5.15.5 or the latest stable release. Revision History: 04/27/2018 - Vulnerability disclosed to vendor 08/10/2018 - Fix available in ActiveMQ 5.15.5 release 08/22/2018 - CVE obtained 08/24/2018 - Advisory published References 1. https://issues.apache.org/jira/browse/AMQ-6954 About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.