CVE-2023-46604

CVE-2023-46604 is a critical vulnerability identified in Apache ActiveMQ, specifically affecting versions prior to 5.15.16, 5.16.7, 5.17.6, and 5.18.3. This flaw, which lies within the Java OpenWire protocol marshaller, allows for Remote Code Execution (RCE) and has been assigned a maximum severity score (CVSS 10). The vulnerability enables unauthenticated threat actors to run arbitrary shell commands. It was patched by Apache at the end of the month preceding its discovery. The vulnerability has attracted significant attention from cybercriminals, with multiple instances of exploitation reported. Rapid7 researchers initially raised concerns about the suspected misuse of this flaw. Cybersecurity researchers at Trend Micro later confirmed these suspicions, identifying attacks where cybercriminals exploited CVE-2023-46604 to infect Linux systems with the Kinsing malware, also known as h2miner. These attacks typically resulted in the installation of cryptocurrency miners on targeted Linux systems. In parallel, Atlassian revealed that its Bamboo continuous integration (CI) and continuous delivery (CD) server, along with Confluence Data Center and Server, were also vulnerable to this max-severity issue. All versions of Bamboo Data Center and Server were found to be impacted by this actively exploited security flaw. Additionally, the AhnLab Security Emergency Response Center (ASEC) implicated Andariel, a subgroup within Lazarus, in cyberattacks exploiting CVE-2023-46604.