Actively exploited · Published Oct 27, 2023 · Assigned by apache
CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Critical 10.0 Exploited Ransomware
In plain English
A critical-severity unsafe deserialization in Apache ActiveMQ from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on November 2, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 23, 2023.
Official description
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | 5.17.2+dfsg-2+deb12u1 | DEBIAN-CVE-2023-46604 |
| Debian:12 | activemq | 5.17.2+dfsg-2+deb12u1 | DSA-5798-1 |
| Debian:13 | activemq | 5.17.6+dfsg-1 | DEBIAN-CVE-2023-46604 |
| Maven | org.apache.activemq:activemq-client | 5.17.6 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-client | 5.18.3 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-client | 5.16.7 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-client | 5.15.16 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.17.6 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.18.3 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.15.16 | GHSA-crg9-44h2-xw35 |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.16.7 | GHSA-crg9-44h2-xw35 |
| Ubuntu:22.04:LTS | activemq | 5.16.1-1ubuntu0.1 | UBUNTU-CVE-2023-46604 |
| Ubuntu:22.04:LTS | activemq | 5.16.1-1ubuntu0.1 | USN-7268-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 5.18.0 – before 5.18.35.17.0 – before 5.17.65.16.0 – before 5.16.70 – before 5.15.16 |
| Apache Software Foundation | Apache ActiveMQ Legacy OpenWire Module | 5.18.0 – before 5.18.35.17.0 – before 5.17.65.16.0 – before 5.16.75.8.0 – before 5.15.16 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
References
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt vendor-advisory
- https://www.openwall.com/lists/oss-security/2023/10/27/5
- https://security.netapp.com/advisory/ntap-20231110-0010/
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
- http://seclists.org/fulldisclosure/2024/Apr/18
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 government-resource