QID 150757

Date Published: 2023-12-12

QID 150757: Apache ActiveMQ Remote Code Execution (RCE) Vulnerability (CVE-2023-46604)

Apache ActiveMQ is a popular open source, multi-protocol, Java-based message broker.

A Remote Code Execution (RCE) Vulnerability exists in the Java OpenWire protocol marshaller allowing remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Affected versions:
Apache ActiveMQ 5.18.0 before 5.18.3
Apache ActiveMQ 5.17.0 before 5.17.6
Apache ActiveMQ 5.16.0 before 5.16.7
Apache ActiveMQ before 5.15.16
Apache ActiveMQ Legacy OpenWire Module 5.18.0 before 5.18.3
Apache ActiveMQ Legacy OpenWire Module 5.17.0 before 5.17.6
Apache ActiveMQ Legacy OpenWire Module 5.16.0 before 5.16.7
Apache ActiveMQ Legacy OpenWire Module 5.8.0 before 5.15.16

QID Detection Logic (Basic Authentication):
This QID sends an authenticated HTTP GET request to "admin/index.jsp" and checks for vulnerable version of Apache ActiveMQ running on the target system.

Successful exploitation of this vulnerability could allow a remote attacker to run arbitrary shell commands on the target system.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised to upgrade Apache ActiveMQ both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 or later to remediate this vulnerability. For more information pertaining to this vulnerability please refer ActiveMQ CVE-2023-46604 update and ActiveMQ Security Advisory

Vendor References

ActiveMQ Security Advisory - activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

CVEs related to QID 150757

CVE-2023-46604 |

Software Advisories

Advisory ID	Software	Component	Link
ActiveMQ Security Advisory			activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].