Apache ActiveMQ和ActiveMQ Legacy OpenWire Module代码执行漏洞

详细信息

漏洞类型

代码问题

漏洞描述

Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。Apache ActiveMQ和ActiveMQ Legacy OpenWire Module 5.15.16之前、5.16.7之前、5.17.6之前或5.18.3之前版本存在代码问题漏洞，该漏洞可能允许具有代理网络访问权限的远程攻击者通过操纵OpenWire协议中的序列化类类型来运行任意shell命令，从而使代理实例化类路径上的任何类。

修复建议

从Apache网站升级至Apache ActiveMQ的最新版本（5.15.16、5.16.7、5.17.6、5.18.3或更高版本）。参考链接： https://activemq.apache.org/

参考链接

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

  OSV · vendor-advisory

• https://www.openwall.com/lists/oss-security/2023/10/27/5

  OSV · Mailing List

• https://security.netapp.com/advisory/ntap-20231110-0010/

  OSV · Third Party Advisory

• http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html

  OSV · VDB Entry · Third Party Advisory · Exploit

• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html

  OSV · Mailing List · Third Party Advisory

• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html

  OSV · VDB Entry · Third Party Advisory · Exploit

• https://jira.atlassian.com/browse/BAM-25444
• https://nvd.nist.gov/vuln/detail/CVE-2023-46604

  OSV

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604

  OSV

• https://issues.apache.org/jira/browse/AMQ-9370

  OSV

• http://www.openwall.com/lists/oss-security/2023/10/27/5

  OSV · Mailing List

• https://github.com/apache/activemq/pull/1098

  OSV

• https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d

  OSV

• https://github.com/advisories/GHSA-crg9-44h2-xw35

  GitHub

• https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436

  Snyk

• https://github.com/apache/activemq/commit/c84b295db83863eff626ecfb67d7e48593b687c5

  Snyk

• https://sploitus.com/exploit?id=E5B5BEE1-1450-5A9D-AB5A-A28171F60645

  Snyk

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  Snyk

• https://github.com/projectdiscovery/nuclei-templates/blob/master/network/cves/2023/CVE-2023-46604.yaml

  Snyk

• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEACTIVEMQ-6039483
• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEACTIVEMQ-6039484
• https://osv.dev/vulnerability/BIT-activemq-2023-46604

  OSV

• https://osv.dev/vulnerability/DLA-3657-1

  OSV

• https://github.com/apache/activemq

  OSV

• https://security.netapp.com/advisory/ntap-20231110-0010

  OSV · Third Party Advisory

• https://osv.dev/vulnerability/GHSA-crg9-44h2-xw35

  OSV

• https://osv.dev/vulnerability/CVE-2023-46604

  OSV

• http://seclists.org/fulldisclosure/2024/Apr/18

  CVE · Mailing List · Third Party Advisory

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-130-03
• https://security-tracker.debian.org/tracker/CVE-2023-46604

  OSV

• https://ubuntu.com/security/CVE-2023-46604

  OSV

• https://www.cve.org/CVERecord?id=CVE-2023-46604

  OSV

• https://ubuntu.com/security/notices/USN-6910-1

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46604

  OSV

• https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc

  GitHub

• https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f

  GitHub

• https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0

  GitHub

• https://ubuntu.com/security/notices/USN-7268-1

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46604

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604

  OSV · US Government Resource · Third Party Advisory

• https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html

  OSV · Mailing List

• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2023-46604

  OSV