Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-46604 PoC — Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a

Source
https://github.com/pavanaa4k/CVE-2023-46604-LAB
Associated Vulnerability
Title:Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack (CVE-2023-46604)
Description:The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Description
Detection, Exploit and Mitigation for CVE 2023 46604.
Readme
# CVE-2023-46604 – Apache ActiveMQ RCE (OpenWire Protocol)
This repository documents a lab environment used to understand and detect the CVE-2023-46604 vulnerability affecting Apache ActiveMQ.

The goal of this project:
- Understand how the exploit behaves at the protocol level  
- Capture malicious OpenWire traffic  
- Build detection rules using Suricata  
- Document steps for educational and defensive security use  

> ⚠️ **Important**: This repository is for educational and defensive security purposes.  
> No exploit code is included here. Only lab setup, detection, and mitigation steps.

## Contents
- Lab network topology  
- ActiveMQ installation notes  
- Wireshark detection steps  
- Suricata IDS rule and configuration  
- Screenshots (redacted and safe to share)  
- Analysis notes
File Snapshot

 [4.0K]  /data/pocs/00639f7e9e096890d353190808204aeae112b619
├── [4.0K]  docs
│   └── [ 514]  lab-steps.md
├── [4.0K]  mitigation-suricata
│   └── [ 113]  local.rules
└── [ 810]  README.md

3 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →