CVE-2023-46604

Published Oct 27, 2023

Last updated 4 months ago

Exploit known CVSS critical 10.0

Apache ActiveMQ

Overview

Description: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Source: security@apache.org
NVD status: Analyzed
Products: activemq, activemq_legacy_openwire_module, debian_linux, e-series_santricity_unified_manager, e-series_santricity_web_services_proxy, santricity_storage_plugin

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Exploit added on: Nov 2, 2023
Exploit action due: Nov 23, 2023
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

security@apache.org: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "28B695E3-E637-44DC-BF2C-A24943EADBA1",
            "versionEndExcluding": "5.15.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D8A5C039-10BA-4D0E-A243-6B313721C7FF",
            "versionEndExcluding": "5.16.7",
            "versionStartIncluding": "5.16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5C8395C4-40D7-4BD3-970B-3F0E32BCB771",
            "versionEndExcluding": "5.17.6",
            "versionStartIncluding": "5.17.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CDA18155-D2AD-459A-94C7-136F981FD252",
            "versionEndExcluding": "5.18.3",
            "versionStartIncluding": "5.18.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2D92110D-B913-4431-B7EB-0C949544E7B8",
            "versionEndExcluding": "5.15.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8476D8D6-8394-4CD0-9E8C-41DCD96983BE",
            "versionEndExcluding": "5.16.7",
            "versionStartIncluding": "5.16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "050649B9-4196-4BA1-9323-6B49E45B2E98",
            "versionEndExcluding": "5.17.6",
            "versionStartIncluding": "5.17.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CE9AE45E-8CDE-4083-A996-D0E90EA0A792",
            "versionEndExcluding": "5.18.3",
            "versionStartIncluding": "5.18.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "BB695329-036B-447D-BEB0-AA4D89D1D99C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "23F148EC-6D6D-4C4F-B57C-CFBCD3D32B41",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*",
            "matchCriteriaId": "82E94B87-065E-475F-815C-F49978CE22FC",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References