CVE-2023-46604 Vulnerability

CVE-2023-46604 is classified as a Remote Code Execution (RCE) vulnerability affecting Apache ActiveMQ. This vulnerability stems from improper input validation and weak protections around serialized object payloads. Exploiting it enables attackers to execute malicious commands on the target system, potentially leading to complete control. CVSS scoring places this vulnerability in the critical severity range, highlighting its high impact.

When was it discovered?

Apache disclosed the vulnerability and released new versions of ActiveMQ on October 25, 2023,during regular product testing. The Apache Foundation issued a public advisory shortly thereafter, including patch details to mitigate risks.

Affected products & versions

CVE-2023-46604 technical description

This vulnerability is caused by insecure deserialization of user-supplied input through the ActiveMQ server’s administrative port. Specifically, a crafted serialized payload can bypass security triggers, leading to the execution of arbitrary code in the runtime. The payload interacts with unsafe reflection mechanisms, making it particularly dangerous in default ActiveMQ configurations.

Tactics, Techniques & Procedures (TTPs)

Attackers exploiting CVE-2023-46604 often utilize phishing vectors or pre-compromised internal systems. Uploaded payloads typically aim to either install backdoors or pivot further attacks within the network ecosystem.

Indicators of Compromise

137.175.17[.]172

172.245.16].]125:80

4.216.93[.]211:5981

27.102.128[.]152:8098

45.32.120[.]181

File Name

Hash

Agent_w.exe

dd13cf13c1fbdc76da63e76adcf36727cfe594e60af0dc823c5a509a13ae1e15

RuntimeBroker.msi

4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910

Known Proof-of-Concepts & Exploits

Proof-of-concept (PoC) code was published shortly after disclosure, making exploitation accessible to a broader set of threat actors. Reports from November 2023 indicate the vulnerability being actively targeted in ransomware campaigns.

Impact & risk of CVE-2023-46604 vulnerability

CVE-2023-46604 poses critical risks, including unauthorized access, confidentiality breaches, and potential ransomware infections. Exploitation tends to disrupt both business processes and sensitive data availability, leading to heavy financial losses and brand reputation damage.

Mitigation & remediation strategies

The Huntress DE&TH team has released a public Sigma detector for this particular threat.

Huntress has added detections for the activity reported in this blog. If you’d like to have someone else watching your back while you work on patching, feel free to start a free trial with us so our 24/7 SOC can keep an eye out for you.