CVE-2023-46604: Remote Code Execution in Apache ActiveMQ
Summary
CVE-2023-46604: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Affects activemq across 4 version ranges.
< 5.15.16
>= 5.16.0, < 5.16.7
>= 5.17.0, < 5.17.6
>= 5.18.0, < 5.18.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.apache.activemq:activemq-client · Maven
- activemq · Debian:11
The same CVE-2023-46604 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ is an open-source message broker that provides support for the Java Message Service (JMS) protocol. It allows applications to communicate with each other by exchanging messages. ActiveMQ is widely used in enterprise environments for reliable messaging and integration. However, a vulnerability has been discovered in the Java OpenWire protocol marshaller, which can lead to remote code execution.
Vulnerability Detail
The Java OpenWire protocol marshaller in Apache ActiveMQ is vulnerable to Remote Code Execution. This vulnerability can be exploited by a remote attacker with network access to either a Java-based OpenWire broker or client. By manipulating serialized class types in the OpenWire protocol, the attacker can cause either the client or the broker to instantiate any class on the classpath, leading to arbitrary shell command execution. This can result in unauthorized access, data leakage, or further compromise of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.15.165.15.16 -
>= 5.16.0, < 5.16.75.16.7 -
>= 5.17.0, < 5.17.65.17.6 -
>= 5.18.0, < 5.18.35.18.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Apache ActiveMQ.
Conclusion
The vulnerability in Apache ActiveMQ's Java OpenWire protocol marshaller poses a significant risk to systems using this message broker. It allows remote attackers to execute arbitrary shell commands, potentially leading to unauthorized access and data leakage. To mitigate this vulnerability, it is crucial to upgrade both brokers and clients to the recommended patched versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Apache ActiveMQ is an open-source message broker that provides support for the Java Message Service (JMS) protocol. It allows applications to communicate with each other by exchanging messages.
This vulnerability allows a remote attacker to execute arbitrary shell commands on a Java-based OpenWire broker or client. It can lead to unauthorized access, data leakage, or further compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade both the brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3. These versions include the necessary patches to mitigate the remote code execution issue.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Apache ActiveMQ.
You can find more information about this vulnerability in the Apache ActiveMQ vulnerability database. Please refer to the provided source link for detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
