Dark Reading23 Jan 2024
Godzilla Web Shell Attacks Stomp on Critical Apache ActiveMQ Flaw
Thousands of vulnerable servers may be open to cyberattacks exploiting the max-severity CVE-2023-46604 bug.
Actively exploited vulnerability
CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
CISA KEV source
2 Nov 2023 added
23 Nov 2023 remediation due
Affected product
Apache ยท ActiveMQ
Known ransomware use: Known
Required action
Follow the source advisory and validate exposure in your environment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Related Yasna coverage
Recent reporting that mentions CVE-2023-46604.
Info Security Magazine30 Nov 2023
GoTitan Botnet and PrCtrl RAT Exploit Apache Vulnerability
Fortiguard Labs identified multiple threat actors leveraging CVE-2023-46604
Info Security Magazine23 Nov 2023
Flaw in Apache ActiveMQ Exposes Linux Systems to Kinsing Malware
Identified as CVE-2023-46604, the vulnerability has a CVSS score of 9.8
Bleeping Computer21 Nov 2023
Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits
The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems. [...]
Trend Micro Research, News and Perspectives20 Nov 2023
CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.