CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-46604 is a critical remote code execution vulnerability in Apache ActiveMQ that allows an unauthenticated attacker with network access to execute arbitrary shell commands on affected brokers and clients. The flaw exists in the Java OpenWire protocol marshaller, which can be manipulated through crafted serialized class types to instantiate arbitrary classes on the classpath, leading to full system compromise. With a maximum CVSS score of 10.0 and an EPSS score of 94.4%, CVE-2023-46604 is one of the most actively exploited vulnerabilities in the wild. CISA has confirmed active exploitation and identified this vulnerability as a known ransomware attack vector, making immediate patching essential for all organizations running Apache ActiveMQ.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | activemq | < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3 |
| apache | activemq legacy openwire module | < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3 |
| debian | debian linux | 10.0; 11.0 |
| netapp | e-series santricity unified manager | - |
| netapp | e-series santricity web services proxy | - |
| netapp | santricity storage plugin | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2024/Apr/18(Mailing List, Third Party Advisory)
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt(Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html(Mailing List)
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://security.netapp.com/advisory/ntap-20231110-0010/(Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2023/10/27/5(Mailing List)
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604(Third Party Advisory, US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
The deserialization of untrusted data weakness in CVE-2023-46604 manifests through the Java OpenWire protocol marshaller in Apache ActiveMQ. The marshaller processes serialized class type information from incoming OpenWire protocol messages without adequate validation, allowing an attacker to specify arbitrary class types that the broker or client will instantiate from the classpath. This unsafe deserialization enables the execution of arbitrary shell commands on the target system.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-46604 carries the maximum CVSS v3.1 score of 10.0 (Critical severity), reflecting its devastating potential impact. The vulnerability is remotely exploitable over the network with Attack Complexity (Low), requiring no special preparation or conditions. Privileges Required (None): No authentication or credentials are needed to exploit this flaw. User Interaction (None): Exploitation is fully automated and requires no action from legitimate users. Scope (Changed): The vulnerability can affect resources beyond the vulnerable ActiveMQ component, meaning compromise of the message broker can lead to lateral movement across the entire infrastructure. Integrity Impact (High) and Availability Impact (High) reflect the attacker's ability to execute arbitrary commands and disrupt services, while Confidentiality Impact (Low) indicates some data exposure risk. The EPSS score of 94.4% (99.99th percentile) places CVE-2023-46604 among the most exploited vulnerabilities globally. CISA has confirmed this vulnerability as a known ransomware attack vector, with multiple threat actor groups actively deploying ransomware through compromised ActiveMQ instances.
Exploit Maturity
Public exploit code is available for CVE-2023-46604 via Packet Storm Security, providing a weaponized proof-of-concept for unauthenticated remote code execution. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 23, 2023. CVE-2023-46604 is a confirmed ransomware attack vector, with multiple threat groups including those deploying HelloKitty ransomware leveraging this vulnerability to gain initial access and deploy payloads. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation activity, consistent with the critical severity, availability of public exploit code, and the widespread deployment of Apache ActiveMQ as a message broker in enterprise environments.
Remediation
- Upgrade Apache ActiveMQ immediately to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 as recommended by the vendor and required by CISA's KEV catalog directive to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- If using Apache ActiveMQ Legacy OpenWire Module, ensure it is also updated to a patched version. Verify all ActiveMQ brokers and clients in your environment are running fixed versions, as both brokers and clients are vulnerable through the OpenWire protocol.
- Restrict network access to ActiveMQ by placing the message broker behind firewalls and ensuring that the OpenWire protocol port (default 61616) is not accessible from untrusted networks. Implement network segmentation to isolate message broker infrastructure from general network traffic.
- Monitor for indicators of compromise including unexpected process execution on ActiveMQ servers, anomalous OpenWire protocol traffic, unauthorized class loading activity, and signs of ransomware deployment. Review system logs and network traffic for evidence of exploitation attempts targeting the OpenWire marshaller.
- Implement application-level hardening by configuring environment variables or system properties to restrict classloading in the OpenWire protocol, maintaining an inventory of all ActiveMQ deployments including development and staging environments, and establishing a process for rapid patching of message broker infrastructure.
Technical Details
CVE-2023-46604 exploits a deserialization of untrusted data (CWE-502) vulnerability in the Java OpenWire protocol marshaller used by Apache ActiveMQ. The OpenWire protocol is ActiveMQ's native binary protocol for communication between brokers and clients, typically running on port 61616. The vulnerability exists in how the marshaller handles serialized class type information within OpenWire messages: an attacker can craft a specially constructed OpenWire command that specifies malicious class types, which the broker or client will deserialize and instantiate from the Java classpath without proper validation. This leads to arbitrary class instantiation and ultimately allows execution of arbitrary shell commands on the target system. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) reflects the critical nature of this flaw, with the Changed scope indicating that exploitation of the ActiveMQ broker can compromise adjacent systems and the broader infrastructure. Both ActiveMQ brokers and clients are vulnerable, meaning an attacker can target either end of an OpenWire connection to achieve remote code execution.
Frequently Asked Questions
Is CVE-2023-46604 being actively exploited?
Yes, CVE-2023-46604 is under widespread active exploitation and has been confirmed as a ransomware attack vector. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 23, 2023. Public exploit code is readily available, and the EPSS score of 94.4% (99.99th percentile) confirms it is among the most actively exploited vulnerabilities globally.
What products are affected by CVE-2023-46604?
CVE-2023-46604 affects Apache ActiveMQ and the Apache ActiveMQ Legacy OpenWire Module. Both message brokers and clients using the OpenWire protocol are vulnerable. Additionally, products embedding ActiveMQ such as NetApp E-Series SANtricity Unified Manager, SANtricity Web Services Proxy, SANtricity Storage Plugin, and Debian Linux packages are affected.
How do I fix CVE-2023-46604?
Upgrade Apache ActiveMQ to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 immediately. Both brokers and clients must be updated. If immediate patching is not possible, restrict network access to the OpenWire protocol port (default 61616) and isolate ActiveMQ from untrusted networks. See the Remediation section for comprehensive guidance.
How severe is CVE-2023-46604?
CVE-2023-46604 has the maximum CVSS v3.1 score of 10.0 (Critical severity), indicating the highest possible impact. It enables unauthenticated remote code execution and is confirmed as a ransomware delivery mechanism. The EPSS score of 94.4% (99.99th percentile) places it among the most dangerous and actively exploited vulnerabilities currently tracked by the cybersecurity community.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.