CVE-2023-46604

10.0

CVSS
Critical

PUBLISHED

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

Exploited in the wild Used in malware Remote Low complexity No user interaction

Vendor: Apache Software Foundation
Product: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module
Published: Oct 27, 2023
EPSS: —

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

apache java cisa malware ransomware nuclei_scanner metasploit

CVSS scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2023-11-02 00:00:00 UTC · Source

Used in malware

Recorded 2023-11-02 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Nov 02, 2023

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

apache_activemq_rce_cve_2023_46604

metasploit · Created Unknown

Metasploit module for CVE-2023-46604

cuanh2333/CVE-2023-46604

github · Created 2024-10-16 03:31:13 UTC · 0 stars

LiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence

github · Created 2023-11-16 02:36:07 UTC · 2 stars

CVE-2023-46604环境复现包

duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell

github · Created 2023-11-12 11:26:46 UTC · 16 stars

This script leverages CVE-2023046604 (Apache ActiveMQ) to generate a pseudo shell. The vulnerability allows for remote code execution due to unsafe deserialization within the OpenWire protocol.

h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up

github · Created 2023-11-09 11:27:20 UTC · 3 stars

justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp

github · Created 2023-11-08 07:48:00 UTC · 5 stars

CVE-2023-46604 Apache ActiveMQ RCE exp 基于python

evkl1d/CVE-2023-46604

github · Created 2023-11-04 11:58:21 UTC · 32 stars

SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ

github · Created 2023-11-03 22:06:09 UTC · 114 stars

Achieving a Reverse Shell Exploit for Apache ActiveMQ (CVE_2023-46604)