CVE-2023-46604 Analysis

A technical analysis repository documenting the root cause, code path, patch points, and reproduction results of Apache ActiveMQ CVE-2023-46604.

This document is learning material for technical analysis and defense perspectives on the publicly disclosed vulnerability CVE-2023-46604.
All experiments were conducted only in approved closed test environments; applying or reproducing this against unauthorized systems may be illegal.
The content of this document is provided solely for the purposes of understanding the vulnerability, validating patches, and strengthening detection and response capabilities.

Overview

CVE-2023-46604 is a remote code execution vulnerability that occurs during OpenWire deserialization processing in Apache ActiveMQ. The core issue is that BaseDataStreamMarshaller.createThrowable() instantiates, via reflection, a class name passed as external input without sufficient validation.

An attacker can exploit this to create a different class instead of an exception object, which can lead to remote XML loading and command execution in the process.

Key Points

• Affected product: Apache ActiveMQ 5.15.x ~ 5.18.x
• Affected versions: 5.15.15 and earlier, 5.16.6 and earlier, 5.17.5 and earlier, 5.18.2 and earlier
• Patched versions: 5.15.16 / 5.16.7 / 5.17.6 / 5.18.3
• Vulnerability type: RCE via insecure deserialization
• Root cause: lack of Throwable subtype validation
• Exploitation flow: ExceptionResponse -> createThrowable() -> arbitrary class creation

Report

The detailed analysis report can be found in the document below.

• CVE-2023-46604 Analysis Report

Repository Structure

.
|- README.md
|- docs/
|  \- CVE-2023-46604_report.md
\- assets/
   \- images...

Highlights

• Analysis of the vulnerable code path
• Explanation of the vulnerable point in createThrowable()
• Changes in validation logic across patched versions
• Summary of reproduction results based on the test environment
• Operational recommendations from response and defense perspectives

References

• Apache Security Advisory
• Apache Jira AMQ-9370
• Rapid7 AttackerKB Analysis
• Public POC Repository
• CVE Details