Flaw in Apache ActiveMQ Exposes Linux Systems to Kinsing Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization CVE-2023-46604 is a critical deserialization flaw (CWE-502) in the Java OpenWire protocol marshaller of Apache ActiveMQ that permits unauthenticated remote code execution (CVSS 9.8). An attacker with network access to either a Java-based OpenWire broker or client can manipulate serialized class types in the OpenWire protocol, causing the peer to instantiate arbitrary classes on the classpath and execute arbitrary shell commands. Successful exploitation yields full command execution on the target broker or client, with no authentication or user interaction required. Affected parties include anyone running ActiveMQ broker or Java client versions prior to 5.15.16, 5.16.7, 5.17.6, or 5.18.3, as well as NetApp E-Series products and Debian packages that ship affected ActiveMQ/OpenWire components. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-11-02 with known ransomware use (RansomHub), and has been used to drop Kinsing malware, Godzilla web shells, and the DripDropper implant, in some cases with attackers patching the flaw post-exploitation to lock out competing intruders. Do: Upgrade all ActiveMQ brokers and Java OpenWire clients to 5.15.16, 5.16.7, 5.17.6, or 5.18.3 (or later), and apply the relevant NetApp E-Series and Debian updates for bundled components; restrict the OpenWire port (default TCP 61616) from untrusted networks. Hunt for indicators of the documented campaigns (Godzilla web shells, Kinsing malware, DripDropper, RansomHub) and verify the broker's current version, since attackers have been observed patching the flaw post-exploitation to hide from defenders. The CISA KEV listing means federal agencies must apply vendor mitigations or discontinue use of the product. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed OpenWire brokers (order of 10,000–100,000 by public scans), plus uncounted internal deployments and bundled NetApp/Debian… | |
| CVE-2023-4911 | Buffer Overflow in GNU C Library ld.so Grants Root via SUID Binaries CVE-2023-4911 ('Looney Tunables') is a buffer overflow in the GNU C Library's dynamic loader (ld.so) that occurs while processing the GLIBC_TUNABLES environment variable. A local attacker triggers it by launching a set-user-ID (SUID) binary with a maliciously crafted GLIBC_TUNABLES value, corrupting memory in the privileged process. This allows the attacker to execute code with elevated (root) privileges on the host. Any system running an affected glibc is potentially exposed, including major Linux distributions (Fedora, Red Hat, Canonical, Debian), Red Hat CodeReady Linux Builder channels, NetApp products, and Siemens SIMATIC S7-1500 firmware, although exploitation requires local execution capability or a foothold on the machine. Exploitation is confirmed in the wild: Qualys published a working proof-of-concept, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-21, and Kinsing threat actors have used it for cryptojacking and to breach cloud environments. Do: Install patched glibc updates from your distribution vendor (Fedora, Red Hat, Canonical/Ubuntu, Debian) and apply Siemens firmware updates for affected SIMATIC S7-1500 MFP devices; NetApp customers should follow NetApp's remediation guidance. Until patched, audit SUID/SGID binaries (which the attacker needs as the escalation trigger) and limit untrusted local access and shell access on multi-user or cloud-hosted Linux systems. Per the CISA KEV required action, apply vendor mitigations or discontinue use, prioritizing internet-facing hosts given active Kinsing cryptojacking and cloud-breach activity. | 7.8 | 81% | KEV PoC ×6 |
| masshundreds of millions of Linux installations worldwide (glibc is the standard C library shipped with virtually every major distribution) |
Full article358 words · extracted from infosecurity-magazine.com · click to collapse
A critical vulnerability in Apache ActiveMQ, identified as CVE-2023-46604, has been exposed, revealing an active exploitation scenario by the notorious Kinsing malware.
According to an advisory published by Trend Micro on Monday, the discovery underscores the implications for Linux systems, as the vulnerability allows for remote code execution (RCE) due to inadequate validation of throwable class types in OpenWire commands.
Apache ActiveMQ, a Java-based open source protocol, is widely used for message-oriented middleware, facilitating seamless communication between diverse applications.
Kinsing, a potent threat specifically targeting Linux-based systems, capitalizes on web application vulnerabilities and misconfigured container environments to infiltrate servers and swiftly propagate across networks.
Reports of active exploitation of CVE-2023-46604 surfaced in November, with threat actors employing exploits such as Metasploit and Nuclei. Despite the severity of the vulnerability (CVSS 9.8), detection remains relatively low.
“The danger with this CVE is that Apache ActiveMQ is widely used, and because it can communicate across multiple protocols (such as MQTT), it is also widely used in non-IT environments to interface to IoT/OT/ICS devices,” explained John Gallagher, vice president of Viakoo Labs at Viakoo.
“Many IoT devices have powerful processing capabilities and lack patching policies, making [crypto]mining an ideal activity for them.”
The Kinsing exploit utilizes the ProcessBuilder method, leading to the download and execution of cryptocurrency miners and malware on compromised systems. Notably, the malware actively seeks and eliminates competing cryptocurrency miners.
The threat actors orchestrating Kinsing exploit not only CVE-2023-46604 but also other high-profile vulnerabilities like CVE-2023-4911 (Looney Tunables).
Read more on Kinsing: Docker Users Targeted with Crypto Malware Via Exposed APIs
Trend Micro urged users to promptly upgrade to mitigate the risks associated with this vulnerability. The patch for CVE-2023-46604 addresses the root cause by introducing the “validateIsThrowable” method in the “BaseDataStreamMarshall” class.
“To guard against this [threat], organizations should prioritize patching and remediation, especially for all external-facing exposure and those with higher-value assets,” said Ken Dunham, director of cyber threat at Qualys.
“Additionally, precautions such as extensive monitoring and logging reviews with workarounds where they apply are recommended to counter known TTPs for brute-force and known attacks until the risk of exploitation is fully remediated.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/apache-activemq-flaw-exposes-linux/