Remote Code Execution Vulnerability Affects Java OpenWire Protocol Marshaller

CVE-2023-46604

9.8CRITICAL

Key Information

Vendor: Apache
Status: Apache ActiveMQ; Apache ActiveMQ Legacy Openwire Module
Vendor: CVE Published:; 27 October 2023

Badges

👾 Exploit Exists🔴 Public PoC🟣 EPSS 97%📰 News Worthy

Summary

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-46604 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Apache ActiveMQ < 5.18.3

Apache ActiveMQ < 5.17.6

Apache ActiveMQ < 5.16.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

ActiveMQ-RCE
Created by X1r0z

CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ
Created by SaumyajeetDas

ActiveMQ_RCE_Pro_Max
Created by JaneMandy