TLDR Tech / InfoSec
13 Year Old Bug in ActiveMQ Lets Hackers Remotely Execute Commands
Researchers using Claude AI discovered a flaw in Apache ActiveMQ Classic that had gone undiscovered for 13 years. The flaw allows attackers to force the broker to fetch a remote Spring XML file and execute arbitrary commands during initialization. The vulnerability normally requires authentication to exploit, but on versions 6.0.0 to 6.1.1, it can be chained with another vulnerability to achieve unauthenticated RCE.
Read the full story