CVE-2023-46604 Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

2023-10-2714:59:31

CWE-502

apache

www.cve.org

apache activemq

legacy openwire

remote code execution

unbounded deserialization

upgrade

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

9.8 High

AI Score

Confidence

High

0.964 High

EPSS

Percentile

99.6%

JSON

The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.

Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-client",
    "product": "Apache ActiveMQ",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.18.3",
        "status": "affected",
        "version": "5.18.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.17.6",
        "status": "affected",
        "version": "5.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.16.7",
        "status": "affected",
        "version": "5.16.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.15.16",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-openwire-legacy",
    "product": "Apache ActiveMQ Legacy OpenWire Module",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.18.3",
        "status": "affected",
        "version": "5.18.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.17.6",
        "status": "affected",
        "version": "5.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.16.7",
        "status": "affected",
        "version": "5.16.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.15.16",
        "status": "affected",
        "version": "5.8.0",
        "versionType": "semver"
      }
    ]
  }
]