CVE-2023-46604

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.16 Apache ActiveMQ versions 5.16.x through 5.16.6 Apache ActiveMQ versions 5.17.x through 5.17.5 Apache ActiveMQ versions 5.18.x through 5.18.2 Bamboo Data Center versions prior to 9.2.7 Bamboo Server versions prior to 9.2.7 Delta Electronics InfraSuite Device Master (affected versions not specified)

Description Remote Code Execution is possible via the Java OpenWire protocol marshaller due to the deserialization of untrusted data. A remote attacker with network access to a Java-based OpenWire broker or client can execute arbitrary shell commands by manipulating serialized class types to instantiate any class on the classpath. Technical exploitation involves using Java Spring classes, such as ClassPathXmlApplicationContext or FileSystemXmlApplicationContext, to load malicious XML configuration files via HTTP or embed SpEL expressions in the init-method attribute to achieve execution in memory. Approximately 3,000 servers worldwide are estimated to be vulnerable. Real-world incidents include the deployment of ransomware by groups such as HelloKitty, TellYouThePass, and LockBit Black, as well as the distribution of SparkRAT.

Recommendations Update Apache ActiveMQ to versions 5.15.16, 5.16.7, 5.17.6, or 5.18.3. Update Bamboo Data Center to version 9.2.7 or later. Update Bamboo Server to version 9.2.7 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Delta Electronics InfraSuite Device Master.