OpenWire-CVE-2023-46604-Investigation
OpenWire Lab
During my shift as a Tier 2 Security Operations Center (SOC) Analyst, I received an escalation from a Tier 1 analyst regarding a publicly accessible server that had been observed communicating with multiple suspicious external IP addresses.
In response, I initiated the standard Incident Response (IR) procedure, which included isolating the affected server from the network to prevent lateral movement and potential data exfiltration. A packet capture (PCAP) file was then obtained from the NSM platform for further investigation.
My objective was to analyze the network traffic and identify any indicators of malicious activity.
- Identifying the First Suspicious External IP Address
After analyzing the network traffic and reviewing connections established with the server, I identified packets related to the OpenWire protocol. Further inspection of these communications revealed a suspicious external IP address involved in the attack:
146.190.21.92
- Identifying the Port Used During the Attack
While examining the OpenWire traffic, I discovered that the targeted service was Apache ActiveMQ, an open-source message broker that enables communication between distributed applications.
Further analysis revealed that the attacker was communicating through the following port:
61616
- Identifying the Second Command-and-Control Server
By analyzing HTTP traffic and reviewing files through:
Export Objects → HTTP Object List
I identified a second external IP address associated with the attacker's infrastructure:
128.199.52.72
- Identifying the Compromised Service
Analysis of the OpenWire communications confirmed that the compromised service was:
Apache ActiveMQ
This service was the primary target of the attack and was later determined to be vulnerable to remote code execution.
- Identifying the Reverse Shell Payload
Attackers often leave traces of their activity on compromised systems. By analyzing both the HTTP traffic and commands executed during the intrusion, I identified the reverse shell file deployed on the server:
docker
- Analyzing the Exploit Chain
During the investigation, I observed suspicious outbound traffic originating from the compromised server using the following User-Agent:
java/11.0.21
The server initiated a connection to the suspicious IP address 146.190.21.92 in order to retrieve a remote XML configuration file named:
/invoice.xml
Using Wireshark and filtering traffic with:
Plain text
ip.addr == 146.190.21.92
I identified the relevant communication stream and extracted the malicious payload file:
./invoice
Further inspection of the payload revealed that the attacker exploited a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ.
The XML file contained malicious instructions that forced the Java Runtime Environment to instantiate a specific Java class capable of executing operating system commands.
The identified Java class was:
java.lang.ProcessBuilder
- Identifying the Associated CVE
Based on the observed attack behavior, including the exploitation of Apache ActiveMQ through OpenWire communications, remote XML retrieval, object instantiation, and the use of java.lang.ProcessBuilder for command execution, the activity was attributed to the following vulnerability:
CVE-2023-46604
This vulnerability allows attackers to achieve Remote Code Execution (RCE) by exploiting unsafe object instantiation mechanisms within Apache ActiveMQ.
Indicators of Compromise (IOCs)
IP Addresses
146.190.21.92
128.199.52.72
Network Port
61616
Files
docker
invoice.xml
Payload
invoice
Vulnerability
CVE-2023-46604
aelshimony-cloud/openwire-cve-2023-46604-investigation
