Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-46604 PoC — Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a

Source
https://github.com/thinkycx/activemq-rce-cve-2023-46604
Associated Vulnerability
Title:Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack (CVE-2023-46604)
Description:The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Description
activemq-rce-cve-2023-46604
Readme

## README

simple analysis for CVE-2023-46604

https://thinkycx.me/2024-04-19-activemq-cve-2023-46604-analysis.html
File Snapshot

 [4.0K]  /data/pocs/7a5726825ebcc6bbbf4ec9b3f06cb865b7fe664a
├── [4.0K]  META-INF
│   └── [ 383]  MANIFEST.MF
├── [1.8K]  pom.xml
├── [ 117]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [4.0K]  org
                ├── [4.0K]  example
                │   ├── [1.8K]  ExceptionResponsePoc.java
                │   ├── [2.1K]  Producer.java
                │   └── [1.5K]  Receiver.java
                └── [4.0K]  springframework
                    └── [4.0K]  context
                        └── [4.0K]  support
                            └── [ 418]  ClassPathXmlApplicationContext.java

9 directories, 7 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →