CVE-2023-46604
About
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Rainforest analyst review
Apache ActiveMQ's OpenWire protocol marshaller deserializes class-type information supplied by the peer without restriction. An attacker with network access to the broker's OpenWire port sends a crafted packet instructing the broker to instantiate an arbitrary class from its classpath and pass it a URL; ActiveMQ fetches and applies a Spring XML bean definition from that URL, which lets the attacker construct objects that spawn a process. The result is unauthenticated remote code execution on the broker, driven entirely by the message body with no login and no user interaction.
ActiveMQ brokers are message-bus infrastructure, typically internal but frequently left with OpenWire exposed on its default port, and they sit at a trusted junction between applications. Exploitation was rapid and broad after disclosure, with ransomware crews (including HelloKitty) and cryptominers among the earliest adopters, and the public proof-of-concept made weaponization trivial. Upgrade to the fixed 5.15.16, 5.16.7, 5.17.6, or 5.18.3 releases, restrict the OpenWire port to trusted hosts, and because the exploitation window opened immediately, inspect brokers for unexpected child processes and dropped payloads rather than trusting the patch alone.
References
- http://seclists.org/fulldisclosure/2024/Apr/18
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
- https://security.netapp.com/advisory/ntap-20231110-0010/
- https://www.openwall.com/lists/oss-security/2023/10/27/5
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604
Related CVEs
Frequently asked questions
What is CVE-2023-46604?
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.
How severe is CVE-2023-46604?
CVE-2023-46604 carries a CVSS 3.1 base score of 10, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 100 out of 100, in the critical band.
How is CVE-2023-46604 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality Low, integrity High and availability High.
Which products are affected by CVE-2023-46604?
Public advisories list the following as affected: activemq, activemq legacy openwire module, debian linux, e-series santricity unified manager, e-series santricity web services proxy, santricity storage plugin. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-46604?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.