CVE-2023-46604

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.16 Apache ActiveMQ versions 5.16.x through 5.16.6 Apache ActiveMQ versions 5.17.x through 5.17.5 Apache ActiveMQ versions 5.18.x through 5.18.2 Bamboo Data Center (affected versions not specified) Bamboo Server (affected versions not specified)

Description The Java OpenWire protocol marshaller is susceptible to Remote Code Execution (RCE) due to the deserialization of untrusted data. A remote attacker with network access to a Java-based OpenWire broker or client can execute arbitrary shell commands by manipulating serialized class types to force the instantiation of any class on the classpath. Technical exploitation involves using the OpenWire protocol to load malicious configuration files via Java Spring classes, such as ClassPathXmlApplicationContext or FileSystemXmlApplicationContext, to achieve RCE without authentication. Approximately 3,000 servers worldwide have been identified as vulnerable. Real-world incidents include the deployment of LockBit ransomware, Mauricrypt, and Cobalt Strike by threat actors such as Andariel, often utilizing certutil.exe to drop stagers and SystemSettingsAdminFlows.exe to disable security software.

Recommendations Update Apache ActiveMQ to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3. Update Bamboo Data Center to version 9.2.7, 9.3.5, 9.4.1 or later. Update Bamboo Server to version 9.2.7, 9.3.5, 9.4.1 or later.