CVE-2023-46604

CVE-2023-46604: Apache ActiveMQ OpenWire Unauthenticated RCE via Deserialization of Untrusted Class Types

AI-generated analysis based on the vulnerability data on this page.

Summary

Apache ActiveMQ's Java OpenWire protocol marshaller is vulnerable to unauthenticated remote code execution. A remote attacker with network access to either a Java-based OpenWire broker or client can manipulate serialized class types in the OpenWire protocol to cause the target to instantiate arbitrary classes on the classpath, resulting in arbitrary shell command execution.

Background

Apache ActiveMQ is a widely deployed open-source message broker implementing the JMS (Java Message Service) specification. The OpenWire protocol is ActiveMQ's native binary wire protocol used for communication between brokers and clients. The protocol includes a marshaller component responsible for serializing and deserializing messages exchanged over the network. Due to its central role in message handling, the OpenWire marshaller is exposed to all network-connected clients and brokers by default.

Root Cause

CWE-502: Deserialization of Untrusted Data

The vulnerability stems from the OpenWire protocol marshaller's handling of serialized class type descriptors. During deserialization, the marshaller trusts the class type information provided in the incoming message without adequate validation. An attacker can craft malicious OpenWire messages containing arbitrary class names that exist on the target's classpath. When the marshaller processes these messages, it instantiates the attacker-specified classes, which can trigger chains of malicious constructors or static initializers, ultimately leading to arbitrary code execution. This represents a classic deserialization vulnerability where the attack surface is the protocol itself, reachable without authentication.

Impact

The CVSS v3.1 score of 10.0 (Critical) reflects the severity of this vulnerability:

• Attack Vector (AV): Network — Exploitable remotely over the network.
• Attack Complexity (AC): Low — No special conditions or advanced techniques required.
• Privileges Required (PR): None — No authentication or credentials needed.
• User Interaction (UI): None — Fully automated exploitation possible.
• Scope (S): Changed — The vulnerable component impacts resources beyond its own security scope.
• Confidentiality (C): Low — Limited information disclosure may occur.
• Integrity (I): High — Complete compromise of system integrity; arbitrary commands can be executed.
• Availability (A): High — System availability can be severely impacted.

The combination of network accessibility, low complexity, and no required privileges means this vulnerability is trivially exploitable by any actor with network reach to an affected broker or client.

Exploitation Walkthrough

An attacker with network access to an ActiveMQ broker or client can craft malicious OpenWire protocol messages that manipulate serialized class type descriptors. When the broker or client unmarshals these messages, it instantiates attacker-controlled classes present on the classpath, leading to arbitrary code execution. This does not require authentication.

This description is provided for defensive awareness only. Actual exploitation requires specific environmental conditions and should only be studied in isolated lab environments with proper authorization. No weaponized exploit code is provided here.

Affected and Patched Versions

Affected:

• Apache ActiveMQ (multiple versions prior to patched releases)
• Apache ActiveMQ Legacy OpenWire Module
• Debian Linux 10.0 and 11.0
• NetApp E-Series SANtricity Unified Manager
• NetApp E-Series SANtricity Web Services Proxy
• NetApp SANtricity Storage Plugin for vCenter

Patched:

• Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3

Remediation

1. Upgrade immediately — Upgrade both ActiveMQ brokers and clients to the patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3) as advised by the Apache Security Team.
2. Network segmentation — Restrict network access to ActiveMQ brokers and clients to trusted hosts only. Do not expose broker ports to untrusted networks or the internet.
3. Input validation — Where possible, implement protocol-level filtering or use alternative wire protocols that do not rely on Java native serialization.
4. Compensating controls — Deploy Web Application Firewalls (WAFs) or intrusion prevention systems with rulesets for ActiveMQ/OpenWire anomaly detection.

Detection

• Monitor network traffic for anomalous OpenWire protocol messages containing unexpected class type descriptors.
• Review broker and client logs for unusual class instantiation errors or unexpected class-loading activity.
• Alert on unexpected process spawning or shell command execution originating from ActiveMQ broker or client JVM processes.
• Use endpoint detection and response (EDR) tools to monitor for suspicious child processes spawned by Java processes running ActiveMQ.

Assessment

With an EPSS score of 0.99654 (99.95th percentile) and confirmed inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog since November 2, 2023, this vulnerability is actively exploited in the wild. The critical CVSS score, absence of authentication requirements, and the ubiquity of ActiveMQ in enterprise messaging infrastructure make this a high-priority patching item.

Key lessons:

1. Deserialization remains a top-tier attack vector — Any protocol or component that deserializes untrusted data must implement strict class-allowlisting or avoid native serialization entirely.
2. Network exposure amplifies risk — Message brokers like ActiveMQ are often deployed internally but can become externally reachable through misconfigurations or supply-chain integrations, dramatically increasing attack surface.

References

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604
• https://security.netapp.com/advisory/ntap-20231110-0010/
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
• https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
• https://www.openwall.com/lists/oss-security/2023/10/27/5
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
• https://nvd.nist.gov/vuln/detail/CVE-2023-46604