Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-46604 PoC — Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a

Source
https://github.com/JaneMandy/ActiveMQ_RCE_Pro_Max
Associated Vulnerability
Title:Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack (CVE-2023-46604)
Description:The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Description
CVE-2023-46604
Readme
# ActiveMQ_RCE_GUI
加强版简称Pro Max
## 版本
### v1.0.3
- 添加版本识别
- 添加验证漏洞版本

### v1.0.2
- 添加代理
- 去掉Help按钮
File Snapshot

 [4.0K]  /data/pocs/03d2b6869af0aaa6627cbc2b26b3cd52e5d3b2b5
├── [1.4K]  pom.xml
├── [ 157]  README.md
└── [4.0K]  src
    ├── [4.0K]  main
    │   ├── [4.0K]  java
    │   │   └── [4.0K]  org
    │   │       ├── [4.0K]  example
    │   │       │   ├── [6.8K]  ActiveMQ_RCE_GUI.form
    │   │       │   ├── [8.3K]  ActiveMQ_RCE_GUI.java
    │   │       │   ├── [ 293]  Main.java
    │   │       │   ├── [ 12K]  Proxy_GUI.form
    │   │       │   └── [2.7K]  Proxy_GUI.java
    │   │       └── [4.0K]  springframework
    │   │           └── [4.0K]  context
    │   │               └── [4.0K]  support
    │   │                   └── [ 315]  ClassPathXmlApplicationContext.java
    │   └── [4.0K]  resources
    │       └── [4.0K]  META-INF
    │           └── [  67]  MANIFEST.MF
    └── [ 116]  Main.java

10 directories, 10 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →