cnvd - cnvd-2023-94073

cnvd-2023-94073

Vulnerability from cnvd

Title: Apache ActiveMQ反序列化漏洞

Description:

Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。

Apache ActiveMQ存在反序列化漏洞，该漏洞源于应用程序在接收用户提交的序列化数据的不安全反序列化处理，具有代理网络访问权限的远程攻击者可利用该漏洞通过操纵OpenWire协议中的序列化类类型来运行任意shell命令。

Severity: 高

Patch Name: Apache ActiveMQ反序列化漏洞的补丁

Patch Description:

Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。

Apache ActiveMQ存在反序列化漏洞，该漏洞源于应用程序在接收用户提交的序列化数据的不安全反序列化处理，具有代理网络访问权限的远程攻击者可利用该漏洞通过操纵OpenWire协议中的序列化类类型来运行任意shell命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Impacted products

Name
['Apache ActiveMQ <5.15.16', 'Apache ActiveMQ >=5.16.0，<5.16.7', 'Apache ActiveMQ >=5.17.0，<5.17.6', 'Apache ActiveMQ >=5.18.0，<5.18.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-46604",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604"
    }
  },
  "description": "Apache ActiveMQ\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u6d88\u606f\u4e2d\u95f4\u4ef6\uff0c\u5b83\u652f\u6301Java\u6d88\u606f\u670d\u52a1\u3001\u96c6\u7fa4\u3001Spring Framework\u7b49\u3002\n\nApache ActiveMQ\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u7a0b\u5e8f\u5728\u63a5\u6536\u7528\u6237\u63d0\u4ea4\u7684\u5e8f\u5217\u5316\u6570\u636e\u7684\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u5904\u7406\uff0c\u5177\u6709\u4ee3\u7406\u7f51\u7edc\u8bbf\u95ee\u6743\u9650\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u64cd\u7eb5OpenWire\u534f\u8bae\u4e2d\u7684\u5e8f\u5217\u5316\u7c7b\u7c7b\u578b\u6765\u8fd0\u884c\u4efb\u610fshell\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-94073",
  "openTime": "2023-11-29",
  "patchDescription": "Apache ActiveMQ\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u6d88\u606f\u4e2d\u95f4\u4ef6\uff0c\u5b83\u652f\u6301Java\u6d88\u606f\u670d\u52a1\u3001\u96c6\u7fa4\u3001Spring Framework\u7b49\u3002\r\n\r\nApache ActiveMQ\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u7a0b\u5e8f\u5728\u63a5\u6536\u7528\u6237\u63d0\u4ea4\u7684\u5e8f\u5217\u5316\u6570\u636e\u7684\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u5904\u7406\uff0c\u5177\u6709\u4ee3\u7406\u7f51\u7edc\u8bbf\u95ee\u6743\u9650\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u64cd\u7eb5OpenWire\u534f\u8bae\u4e2d\u7684\u5e8f\u5217\u5316\u7c7b\u7c7b\u578b\u6765\u8fd0\u884c\u4efb\u610fshell\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache ActiveMQ\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache ActiveMQ \u003c5.15.16",
      "Apache ActiveMQ \u003e=5.16.0\uff0c\u003c5.16.7",
      "Apache ActiveMQ \u003e=5.17.0\uff0c\u003c5.17.6",
      "Apache ActiveMQ \u003e=5.18.0\uff0c\u003c5.18.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604",
  "serverity": "\u9ad8",
  "submitTime": "2023-10-31",
  "title": "Apache ActiveMQ\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"
}

CVE-2023-46604 (GCVE-0-2023-46604)

Vulnerability from cvelistv5

Published

2023-10-27 14:59

Modified

2025-07-30 01:37

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Summary

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

References

▼	URL	Tags
	https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt	vendor-advisory
	https://www.openwall.com/lists/oss-security/2023/10/27/5
	https://security.netapp.com/advisory/ntap-20231110-0010/
	https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
	https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
	http://seclists.org/fulldisclosure/2024/Apr/18

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache ActiveMQ

Version: 5.18.0   ≤
Version: 5.17.0   ≤
Version: 5.16.0   ≤
Version: 0   ≤

Apache Software Foundation

Apache ActiveMQ Legacy OpenWire Module

Version: 5.18.0   ≤
Version: 5.17.0   ≤
Version: 5.16.0   ≤
Version: 5.8.0   ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:42.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/10/27/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231110-0010/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Apr/18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46604",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T15:16:07.619940Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-11-02",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:37:13.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2023-11-02T00:00:00+00:00",
            "value": "CVE-2023-46604 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-client",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.18.3",
              "status": "affected",
              "version": "5.18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17.6",
              "status": "affected",
              "version": "5.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.7",
              "status": "affected",
              "version": "5.16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-openwire-legacy",
          "product": "Apache ActiveMQ Legacy OpenWire Module",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.18.3",
              "status": "affected",
              "version": "5.18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17.6",
              "status": "affected",
              "version": "5.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.7",
              "status": "affected",
              "version": "5.16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.16",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "yejie@threatbook.cn"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.\u003c/div\u003e"
            }
          ],
          "value": "The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-11T08:05:50.028Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/10/27/5"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231110-0010/"
        },
        {
          "url": "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Apr/18"
        }
      ],
      "source": {
        "defect": [
          "AMQ-9370"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-46604",
    "datePublished": "2023-10-27T14:59:31.046Z",
    "dateReserved": "2023-10-24T08:55:31.050Z",
    "dateUpdated": "2025-07-30T01:37:13.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted