CVE-2016-4974

HIGH

Apache Qpid AMQP JMS Client < 6.0.4 & JMS (AMQP 1.0) < 0.10.0 - RCE via JMS ObjectMessage Deserialization

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2016-4974. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository contains source code for Apache Qpid Broker-J, specifically the BerkeleyDB store component, which is vulnerable to CVE-2016-4974. The code includes JMX management beans and backup scripts, but no explicit exploit PoC is present.

Description

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.

Exploits (2)

nomisec WRITEUP

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2016-4974-qpid-broker-j-vulnerable

View Code ZIP pw:eip

This repository contains source code for Apache Qpid Broker-J, specifically the BerkeleyDB store component, which is vulnerable to CVE-2016-4974. The code includes JMX management beans and backup scripts, but no explicit exploit PoC is present.

Classification

Writeup 90%

Attack Type

Other

Complexity

Moderate

Reliability

Theoretical

Target: Apache Qpid Broker-J (BerkeleyDB store component)

No auth needed

Prerequisites: Access to vulnerable Qpid Broker-J instance

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Mar 14, 2026 Full analysis →