// For flags

CVE-2023-46604

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

15
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.

Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.

Apache ActiveMQ es vulnerable a la ejecución remota de código. La vulnerabilidad puede permitir que un atacante remoto con acceso a la red de un corredor ejecute comandos de shell arbitrarios manipulando tipos de clases serializadas en el protocolo OpenWire para hacer que el corredor cree una instancia de cualquier clase en el classpath. Se recomienda a los usuarios actualizar a la versión 5.15.16, 5.16.7, 5.17.6 o 5.18.3, que soluciona este problema.

A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate any class on the classpath. This issue happens when OpenWire commands are unmarshalled, without validating the provided throwable class type, which could allow an attacker to jeopardize the entire server.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics InfraSuite Device Master. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Apache ActiveMQ broker, which listens on TCP port 61616 by default. The issue results from the use of a vulnerable version of Apache ActiveMQ. An attacker can leverage this vulnerability to execute code in the context of the service account.

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

*Credits: yejie@threatbook.cn
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-10-24 CVE Reserved
  • 2023-10-27 CVE Published
  • 2023-11-02 Exploited in Wild
  • 2023-11-03 First Exploit
  • 2023-11-23 KEV Due Date
  • 2024-08-02 CVE Updated
  • 2024-11-02 EPSS Updated
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (25)
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Activemq
Search vendor "Apache" for product "Activemq"
< 5.15.16
Search vendor "Apache" for product "Activemq" and version " < 5.15.16"
-
Affected
Apache
Search vendor "Apache"
Activemq
Search vendor "Apache" for product "Activemq"
>= 5.16.0 < 5.16.7
Search vendor "Apache" for product "Activemq" and version " >= 5.16.0 < 5.16.7"
-
Affected
Apache
Search vendor "Apache"
Activemq
Search vendor "Apache" for product "Activemq"
>= 5.17.0 < 5.17.6
Search vendor "Apache" for product "Activemq" and version " >= 5.17.0 < 5.17.6"
-
Affected
Apache
Search vendor "Apache"
Activemq
Search vendor "Apache" for product "Activemq"
>= 5.18.0 < 5.18.3
Search vendor "Apache" for product "Activemq" and version " >= 5.18.0 < 5.18.3"
-
Affected
Apache
Search vendor "Apache"
Activemq Legacy Openwire Module
Search vendor "Apache" for product "Activemq Legacy Openwire Module"
< 5.15.16
Search vendor "Apache" for product "Activemq Legacy Openwire Module" and version " < 5.15.16"
-
Affected
Apache
Search vendor "Apache"
Activemq Legacy Openwire Module
Search vendor "Apache" for product "Activemq Legacy Openwire Module"
>= 5.16.0 < 5.16.7
Search vendor "Apache" for product "Activemq Legacy Openwire Module" and version " >= 5.16.0 < 5.16.7"
-
Affected
Apache
Search vendor "Apache"
Activemq Legacy Openwire Module
Search vendor "Apache" for product "Activemq Legacy Openwire Module"
>= 5.17.0 < 5.17.6
Search vendor "Apache" for product "Activemq Legacy Openwire Module" and version " >= 5.17.0 < 5.17.6"
-
Affected
Apache
Search vendor "Apache"
Activemq Legacy Openwire Module
Search vendor "Apache" for product "Activemq Legacy Openwire Module"
>= 5.18.0 < 5.18.3
Search vendor "Apache" for product "Activemq Legacy Openwire Module" and version " >= 5.18.0 < 5.18.3"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Netapp
Search vendor "Netapp"
E-series Santricity Unified Manager
Search vendor "Netapp" for product "E-series Santricity Unified Manager"
--
Affected
Netapp
Search vendor "Netapp"
E-series Santricity Web Services Proxy
Search vendor "Netapp" for product "E-series Santricity Web Services Proxy"
--
Affected
Netapp
Search vendor "Netapp"
Santricity Storage Plugin
Search vendor "Netapp" for product "Santricity Storage Plugin"
-vcenter
Affected