A cross site scripting (XSS) vulnerability exists in Apache ActiveMQprior to version 5.15.5. Apache ActiveMQ is a popular open source message broker acting as a middle man to communicate data between other software. The vulnerability is a reflected XSS bug that takes advantage of a "QueueFilter" parameter. This could be exploited by feeding a URL encoded script to the parameter in the URI like so:
http:// localhost:8161/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%22SpiderLabs%22)%3c%2fscript%3eqb68
Cross Site Scriptingis a very common class of website vulnerabilities that allow an attacker to inject their own unauthorized code into the code of a website when it is visited. Despite being one of the most common website bugs, XSS often goes underestimated and unaddressed. This is typically because XSS doesn't affect the web server itself. Instead only the clients, the web browsers, visiting the website are affected, which you would think would be just as big a concern. Also XSS is typically demonstrated by triggering an innocuous pop up like our example above. However, XSS is quite easy to weaponize into a real threat to your customers and clients. Open frameworks exist like The Browser Exploitation Framework(BeEF) that streamline the entire process.
Apache fixed this vulnerability in ActiveMQ version 5.15.5, so if you are running ActiveMQ in your environment, make sure you upgrade.