PT-2023-6605 · Apache+4 · Apache Activemq+4

[e-mail] · Published 2023-10-27 · Updated 2026-06-09 · CVE-2023-46604

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.16 Apache ActiveMQ versions 5.16.x through 5.16.6 Apache ActiveMQ versions 5.17.x through 5.17.5 Apache ActiveMQ versions 5.18.x through 5.18.2 Bamboo Data Center (affected versions not specified) Bamboo Server (affected versions not specified) Delta Electronics InfraSuite Device Master (affected versions not specified)

Description The Java OpenWire protocol marshaller is susceptible to remote code execution due to the deserialization of untrusted data. A remote attacker with network access to a Java-based OpenWire broker or client can execute arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, forcing the application to instantiate any class on the classpath. Technical exploitation involves using a maliciously crafted OpenWire command and leveraging Java Spring classes, such as ClassPathXmlApplicationContext or FileSystemXmlApplicationContext, to load malicious XML configuration files via HTTP or embed SpEL expressions in the init-method attribute to achieve execution in memory.

Approximately 3,000 servers worldwide, primarily in China, the USA, and Russia, have been identified as vulnerable. Real-world incidents include attacks by threat actors such as Andariel and the deployment of LockBit, HelloKitty, and TellYouThePass ransomware, as well as SparkRAT and Cobalt Strike. In one instance, attackers used certutil.exe to drop a Metasploit stager and later utilized RDP and the SystemSettingsAdminFlows.exe LOLBIN to disable Windows Defender and encrypt the environment.

Recommendations Upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3. Upgrade Bamboo Data Center and Server to versions 9.2.7, 9.3.5, 9.4.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Delta Electronics InfraSuite Device Master.

Exploit

Fix

RCE

DoS

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

APACHEACTIVEMQ_CVE2023_46604

BDU:2023-07372

BIT-ACTIVEMQ-2023-46604

CVE-2023-46604

DLA-3657-1

DLA-3936-1

DSA-5798-1

GHSA-CRG9-44H2-XW35

OESA-2023-1778

USN-6910-1

USN-7268-1

ZDI-24-440

Affected Products

Apache Activemq

Bamboo

Linuxmint

Red Os

Ubuntu

References · 398

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/X1r0z/ActiveMQ-RCE · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/JaneMandy/ActiveMQ_RCE_Pro_Max · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/trganda/ActiveMQ-RCE · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• 🔥 https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-46604 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-activemq-2023-46604 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46604 · Security Note