PT-2023-6605 · Apache +4 · Apache Activemq +4

[e-mail] · Published 2023-10-27 · Updated 2025-11-29 · CVE-2023-46604

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.16 Apache ActiveMQ versions 5.16.x prior to 5.16.7 Apache ActiveMQ versions 5.17.x prior to 5.17.6 Apache ActiveMQ versions 5.18.x prior to 5.18.3 Bamboo Data Center versions prior to 9.2.7 Bamboo Data Center versions prior to 9.3.5 Bamboo Data Center versions prior to 9.4.1

Description Apache ActiveMQ is susceptible to a Remote Code Execution (RCE) vulnerability (CVE-2023-46604) due to insecure deserialization of data within the OpenWire protocol. Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code on the server. This vulnerability has been actively exploited in the wild by threat actors, including those associated with the HelloKitty, Kinsing, and Mauri ransomware groups, as well as the Tsunami botnet. Attackers have been observed deploying malware, including ransomware, cryptocurrency miners, and DDoS botnets, and in some cases, patching the vulnerability post-exploitation to maintain persistence and evade detection. The vulnerability allows attackers to manipulate serialized class types, enabling them to instantiate any class on the classpath. Exploitation can occur without authentication.

Recommendations Upgrade Apache ActiveMQ to version 5.15.16 or later. Upgrade Apache ActiveMQ to version 5.16.7 or later. Upgrade Apache ActiveMQ to version 5.17.6 or later. Upgrade Apache ActiveMQ to version 5.18.3 or later. Upgrade Bamboo Data Center to version 9.2.7 or later. Upgrade Bamboo Data Center to version 9.3.5 or later. Upgrade Bamboo Data Center to version 9.4.1 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

APACHEACTIVEMQ_CVE2023_46604

BDU:2023-07372

BIT-ACTIVEMQ-2023-46604

CVE-2023-46604

DLA-3657-1

DLA-3936-1

DSA-5798-1

GHSA-CRG9-44H2-XW35

OESA-2023-1778

USN-6910-1

USN-7268-1

ZDI-24-440

Affected Products

Apache Activemq

Bamboo

Linuxmint

Red Os

Ubuntu

References · 377

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/X1r0z/ActiveMQ-RCE · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/JaneMandy/ActiveMQ_RCE_Pro_Max · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/trganda/ActiveMQ-RCE · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• 🔥 https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7559 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1778 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46604 · Vendor Advisory