New PoC Exploit for Apache ActiveMQ Flaw Could Let Attackers Fly Under the Radar

Cybersecurity scientists have shown a new procedure that exploits a critical security flaw in Apache ActiveMQ to obtain arbitrary code execution in memory.

Tracked as CVE-2023-46604 (CVSS rating: 10.), the vulnerability is a distant code execution bug that could permit a risk actor to run arbitrary shell instructions.

It was patched by Apache in ActiveMQ versions 5.15.16, 5.16.7, 5.17.6, or 5.18.3 produced late past month.

The vulnerability has considering the fact that occur below lively exploitation by ransomware outfits to deploy ransomware these as HelloKitty and a strain that shares similarities with TellYouThePass as perfectly as a distant accessibility trojan called SparkRAT.

In accordance to new results from VulnCheck, threat actors weaponizing the flaw are relying on a community proof-of-strategy (PoC) exploit initially disclosed on Oct 25, 2023.

The attacks has been located to use ClassPathXmlApplicationContext, a course that is part of the Spring framework and out there inside of ActiveMQ, to load a destructive XML bean configuration file above HTTP and accomplish unauthenticated distant code execution on the server.

VulnCheck, which characterised the approach as noisy, has engineered a much better exploit that depends on the FileSystemXmlApplicationContext course and embeds a specifically crafted SpEL expression in position of the “init-strategy” attribute to reach the identical benefits and even obtain a reverse shell.

“That indicates the risk actors could have prevented dropping their applications to disk,” VulnCheck claimed. “They could have just written their encryptor in Nashorn (or loaded a class/JAR into memory) and remained memory resident.”

However, it is really worth noting that doing so triggers an exception information in the activemq.log file, necessitating that the attackers also just take steps to thoroughly clean up the forensic path.

“Now that we know attackers can execute stealthy attacks utilizing CVE-2023-46604, it really is develop into even a lot more essential to patch your ActiveMQ servers and, ideally, take away them from the internet fully,” the cybersecurity agency stated.

Discovered this short article fascinating? Adhere to us on Twitter  and LinkedIn to examine more unique articles we post.

Some components of this posting are sourced from:
thehackernews.com