Full Report
CVE-2023-46604 is a critical remote code execution vulnerability in Apache ActiveMQ. Patch now to avoid any potential adversary exploitation.
Analysis Summary
# Vulnerability: Apache ActiveMQ Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2023-46604
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data) / OpenWire Marshaler flaw
## Affected Systems
- **Products:** Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module
- **Versions:**
- 5.18.0 before 5.18.3
- 5.17.0 before 5.17.6
- 5.16.0 before 5.16.7
- 5.15.0 before 5.15.16
- **Configurations:** Systems running the OpenWire protocol (typically on port 61616) that are accessible to the network/internet.
## Vulnerability Description
This vulnerability resides in the OpenWire protocol marshaler. It allows a remote attacker to trigger the deserialization of untrusted class types, which can be leveraged to execute arbitrary shell commands. Specifically, attackers provide a malicious class name that the server attempts to instantiate, leading to Remote Code Execution (RCE) via the `java.exe` process under the ActiveMQ `wrapper.exe` service.
## Exploitation
- **Status:** Exploited in the wild (Linked to "HelloKitty" ransomware deployments).
- **Complexity:** Low
- **Attack Vector:** Network
- **PoC Availability:** Publicly available; multiple security researchers have released proof-of-concept exploits.
## Impact
- **Confidentiality:** Critical
- **Integrity:** Critical
- **Availability:** Critical
## Remediation
### Patches
Update to the following versions immediately:
- **5.15.16**
- **5.16.7**
- **5.17.6**
- **5.18.3**
### Workarounds
- **Network Segmentation:** Immediately block access to the ActiveMQ ports (default 61616) from the public internet.
- **Access Control:** Restrict access to the broker to known, trusted IP addresses only.
## Detection
- **Indicators of Compromise (IoCs):**
- **Processes:** `java.exe` spawning `cmd.exe` or `msiexec.exe`.
- **Malicious Domains/IPs:**
- `172.245.16[.]125`
- `4.216.93[.]211:5981`
- **Files:** Attempts to download `.png` files that are actually MSI installers (e.g., `m4.png`, `m2.png`) or `RuntimeBroker.msi`.
- **Detection Methods:**
- Review **MsiInstaller Event ID 1033** in the Application Event Log for suspicious remote URL sources.
- Monitor for `wrapper.exe -> java.exe -> cmd.exe /c msiexec /q /i http://...` process lineages.
- Use the command `activemq --version` to identify vulnerable instances.
## References
- **Vendor Advisory:** [https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt)
- **Huntress Analysis:** [https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604](https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604)
- **Rapid7 Research:** [https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/](https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/)