Remote Code Execution Vulnerability Affects Java OpenWire Protocol Marshaller
CVE-2023-46604

9.8CRITICAL

Key Information:

Vendor: Apache
Status: Apache ActiveMQ; Apache ActiveMQ Legacy Openwire Module
Vendor: CVE Published:; 27 October 2023

Badges

📈 Score: 167💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 97%🦅 CISA Reported📰 News Worthy

What is CVE-2023-46604?

CVE-2023-46604 is a significant vulnerability affecting the Java OpenWire protocol marshaller, which is part of the Apache ActiveMQ messaging server. This vulnerability permits remote code execution, where an attacker with network access to a Java-based OpenWire broker or client can exploit the flaw to execute arbitrary shell commands. By manipulating serialized class types within the OpenWire protocol, attackers can compel the system to instantiate any arbitrary class available on the classpath, potentially compromising the entire system. This presents a critical risk to organizations relying on Apache ActiveMQ for messaging services, as it can lead to unauthorized access and system exploitation.

Technical Details

The vulnerability arises from the way the Java OpenWire protocol marshaller handles serialized data. When an attacker gains network access, they can manipulate the serialized class types being transmitted, leading to unintended class instantiation. This exploitation can occur in both broker and client scenarios, making it imperative for organizations to secure both components. The affected software versions must be upgraded to the latest releases—5.15.16, 5.16.7, 5.17.6, or 5.18.3—to remediate this vulnerability effectively.

Potential Impact of CVE-2023-46604

Remote Code Execution: The primary impact of this vulnerability is the possibility for attackers to execute arbitrary code on affected systems. This could lead to complete system compromise, where attackers can install malware, modify files, or engage in data exfiltration.
Data Breaches: Given the capabilities of remote code execution, attackers may access sensitive data stored within the messaging systems. This poses risks relating to data integrity and confidentiality, leading to substantial compliance and reputational damages for affected organizations.
Service Disruption: Attackers could leverage this vulnerability to disrupt messaging services by altering broker behavior or manipulating client communications. This disruption can result in downtime, affecting business operations that rely on effective messaging for communication and data transfer.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Apache ActiveMQ 5.18.0 < 5.18.3

Apache ActiveMQ 5.17.0 < 5.17.6

Apache ActiveMQ 5.16.0 < 5.16.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

ActiveMQ-RCE
Created by X1r0z

CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ
Created by SaumyajeetDas

ActiveMQ_RCE_Pro_Max
Created by JaneMandy