Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization CVE-2023-46604 is a critical deserialization flaw (CWE-502) in the Java OpenWire protocol marshaller of Apache ActiveMQ that permits unauthenticated remote code execution (CVSS 9.8). An attacker with network access to either a Java-based OpenWire broker or client can manipulate serialized class types in the OpenWire protocol, causing the peer to instantiate arbitrary classes on the classpath and execute arbitrary shell commands. Successful exploitation yields full command execution on the target broker or client, with no authentication or user interaction required. Affected parties include anyone running ActiveMQ broker or Java client versions prior to 5.15.16, 5.16.7, 5.17.6, or 5.18.3, as well as NetApp E-Series products and Debian packages that ship affected ActiveMQ/OpenWire components. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-11-02 with known ransomware use (RansomHub), and has been used to drop Kinsing malware, Godzilla web shells, and the DripDropper implant, in some cases with attackers patching the flaw post-exploitation to lock out competing intruders. Do: Upgrade all ActiveMQ brokers and Java OpenWire clients to 5.15.16, 5.16.7, 5.17.6, or 5.18.3 (or later), and apply the relevant NetApp E-Series and Debian updates for bundled components; restrict the OpenWire port (default TCP 61616) from untrusted networks. Hunt for indicators of the documented campaigns (Godzilla web shells, Kinsing malware, DripDropper, RansomHub) and verify the broker's current version, since attackers have been observed patching the flaw post-exploitation to hide from defenders. The CISA KEV listing means federal agencies must apply vendor mitigations or discontinue use of the product. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed OpenWire brokers (order of 10,000–100,000 by public scans), plus uncounted internal deployments and bundled NetApp/Debian… |
Full article503 words · extracted from helpnetsecurity.com · click to collapse
Ransomware-wielding attackers are trying to break into servers running outdated versions of Apache ActiveMQ by exploiting a recently fixed vulnerability (CVE-2023-46604).
“Beginning Friday, October 27, Rapid7 Managed Detection and Response (MDR) identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer environments. In both instances, the adversary attempted to deploy ransomware binaries on target systems in an effort to ransom the victim organizations,” Rapid7 researchers shared on Wednesday.
“Based on the ransom note and available evidence, we attribute the activity to the HelloKitty ransomware family, whose source code was leaked on a forum in early October.”
About CVE-2023-46604
Apache ActiveMQ is an open source message broker – a program that translates messages from one messaging protocol to another, allowing communication between diverse services.
ActiveMQ supports a variety of protocols, including OpenWire (the native wire format of ActiveMQ), MQTT (messaging protocol for IoT), AMQP (protocol for business messaging and IoT device management), REST, STOMP, and WebSockets.
CVE-2023-46604 is an unauthenticated deserialization vulnerability in ActiveMQ’s OpenWire transport connector, which is enabled by default.
“Successful exploitation allows an attacker to execute arbitrary code with the same privileges of the ActiveMQ server,” Rapid7’s researchers explained.
CVE-2023-46604 affects:
- Apache ActiveMQ 5.18.0 before 5.18.3
- Apache ActiveMQ 5.17.0 before 5.17.6
- Apache ActiveMQ 5.16.0 before 5.16.7
- Apache ActiveMQ before 5.15.16
- Apache ActiveMQ Legacy OpenWire Module 5.18.0 before 5.18.3
- Apache ActiveMQ Legacy OpenWire Module 5.17.0 before 5.17.6
- Apache ActiveMQ Legacy OpenWire Module 5.16.0 before 5.16.7
- Apache ActiveMQ Legacy OpenWire Module 5.8.0 before 5.15.16
ActiveMQ project maintainers have released the fixed versions on October 25 and 26. On October 27 – the same day that the security researcher who goes by “X1r0z” published a proof of concept exploit for CVE-2023-46604 – they disclosed that they have patched it.
Mitigation and remediation
According to the Shadowserver Foundation, there are around 3,200 vulnerable ActiveMQ installations accessible from the internet. Most od them are in Asia, Europe and North America.
Enterprise admins are advised to upgrade their ActiveMQ installation to a fixed release and look for signs of compromise. Rapid7 has provided helpdul details about the attackers’ behavior and indicators of compromise.
UPDATE (November 6, 2023, 07:30 a.m. ET):
“Arctic Wolf Labs has gathered forensic evidence showing that CVE-2023-46604 was being exploited in the wild as early as October 10, 2023, prior to the disclosure of a CVE or proof of concept exploitation code. After exploiting CVE-2023-46604, 45.32.120[.]181 was observed deploying SparkRAT[2],” Arctic Wolf researchers have shared.
“More recently, two separate ransomware campaigns were observed exploiting this vulnerability for initial access, originating from the IP address 172.245.16[.]125. This IP address was observed delivering additional payloads as part of the ransomware attacks.”
They say that IoCs (IP address, domains, Bitcoin wallet address) associated with this intrusion overlap with those of previous intrusions where the TellYouThePass ransomware was deployed.
ActiveMQ maintainers have confirmed that both ActiveMQ “Classic” and ActiveMQ Artemis have the vulnerable code, but that Artemis “doesn’t ship Spring so there is currently no known exploit.”
Security updates for both flavors are available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/11/02/cve-2023-46604-ransomware/