CVE-2023-46604
CISA 기관 조치 기한: 2023-11-23
Apache ActiveMQ
영향 패키지: maven/org.apache.activemq:activemq-client, maven/org.apache.activemq:activemq-openwire-legacy
Qualys 위협 인텔 · 심각도 5/5 · QID 150757 · Web Application
공개 익스플로잇
실제 공격 관측
측면이동
쉬운 악용
대량 데이터 유출
서비스 거부
악성코드 연계
웜 전파
인증 불필요
원격코드실행
랜섬웨어 연계
CISA KEV
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
KEV 필수 조치: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
타임라인
- NVD 공개
- CISA KEV 등재(실제 악용 확인) 공개 후 6일
- CISA 기관 조치 기한 경과
- 첫 보도 The DFIR Report · 아파치 ActiveMQ 취약점 악용으로 인한 LockBit 랜섬웨어 감염
- 최근 보도 (총 3건) 안랩 ASEC · ARTEX로 살펴본 AI 자율 침투의 위협
날짜 정보 없는 신호: 랜섬웨어 캠페인 악용 공개 PoC 34건 실제 공격 관측 웜 전파
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
공개 익스플로잇 / PoC
- GitHub 공개 PoC 34건 — 대표 레포 ↗