CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data

What is CVE-2023-46604?

CVE-2023-46604 is a critical unsafe deserialization vulnerability in Apache Activemq, published on 27 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Weakness: CWE-502

Which versions are affected by CVE-2023-46604?

17 open source packages ship an affected version, including org.apache.activemq:activemq-client, activemq and org.apache.activemq:activemq-openwire-legacy. It affects 6 products.

Products include Apache Activemq, Apache Activemq Legacy Openwire Module, Debian Debian Linux, Netapp E-Series Santricity Unified Manager, Netapp E-Series Santricity Web Services Proxy, Netapp Santricity Storage Plugin.

How do I fix CVE-2023-46604?

Upgrade org.apache.activemq:activemq-client to a fixed version for your release line: 5.15.16, 5.16.7, 5.17.6 or 5.18.3. US federal agencies must fix it by 23 Nov 2023.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-46604 being exploited?

Yes. Attackers have exploited CVE-2023-46604 in the wild since at least 2 Nov 2023, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 42 proofs of concept on GitHub.

Other vulnerabilities in Apache Activemq

• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8
• CVE-2014-3600 Improper Restriction of XML External Entity Reference in Apache ActiveMQ Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-activemq-2023-46604, DEBIAN-CVE-2023-46604, GHSA-crg9-44h2-xw35, OESA-2023-1778, ROOT-APP-MAVEN-CVE-2023-46604, UBUNTU-CVE-2023-46604.