Apache ActiveMQ CVE-2023-46604 (OpenWire deserialization remote code execution, exploited for ransomware, CISA KEV): which versions fix it and what if the broker was reachable?

What it is: CVE-2023-46604 is a flaw in the Java OpenWire protocol handling in Apache ActiveMQ that lets a remote attacker with network access to the broker (or a client) make it instantiate arbitrary classes available on its classpath, resulting in command execution. Apache disclosed it on October 27, 2023, and attackers quickly used it to deploy ransomware and malware. It is in CISA's KEV catalog (added 2023-11-02) with known ransomware use. Am I affected: - ActiveMQ Classic before 5.15.16, 5.16.0 to before 5.16.7, 5.17.0 to before 5.17.6, and 5.18.0 to before 5.18.3, as well as the same ranges of the Legacy OpenWire Module. Apache says both brokers and clients should be upgraded. - The risk is mainly brokers whose OpenWire port (commonly 61616) is reachable by untrusted hosts. Check the version in the broker's startup log, the admin console, or the activemq-broker jar file name. Fix: 1. Upgrade brokers and clients to 5.15.16, 5.16.7, 5.17.6, 5.18.3 or newer; best, move to the current supported release. 2. Until upgraded, block the OpenWire port from the internet and untrusted networks with firewall rules. 3. If a vulnerable broker was reachable, assume compromise: check for unexpected child processes of the Java broker, new binaries or scripts in temporary directories, odd outbound connections, and ransom notes or encrypted files. Rebuild the host from a known-good image, restore data, and rotate credentials the broker could access, including connection credentials and keys on the same host. Verify: the running version is a fixed release and only intended application hosts can reach the OpenWire port. Sources: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt https://nvd.nist.gov/vuln/detail/CVE-2023-46604 https://www.cisa.gov/known-exploited-vulnerabilities-catalog