skrkcb2/cve-2023-46604In-depth technical analysis of CVE-2023-46604, an RCE vulnerability in Apache ActiveMQ's OpenWire protocol, including packet structure breakdown and exploitation mechanism.
ActiveMQ is an open-source messaging and integration pattern server that supports communication between systems using various languages, not just Java, as well as a broker including clients that support JMS. It also maintains consistency and persistence between systems through clustering, database, and FileSystem.
OpenWire is a binary messaging protocol used in Apache ActiveMQ. It is designed for efficient data transfer between the broker (ActiveMQ) and clients.
CVE-2023-46604 is a vulnerability in the OpenWire protocol (during the marshaling process) in ActiveMQ. A remote attacker with network access to a Java-based OpenWire broker or client can manipulate serialized class types in the OpenWire protocol to execute arbitrary shell commands, causing the client or broker (respectively) to instantiate any class on the classpath. It is one of the attack methods prominently used by the APT group Andariel.
CVE-2023-46604 is carried out by manipulating XML calls or inserting malicious data during the data exchange process through the OpenWire protocol to execute remote commands. The OpenWire protocol handles data serialization and transmission; the vulnerability exploits the fact that malicious class types are permitted during this serialization process.
[Figure] POC
[Figure] XML
Packet Header
+----------------------------------------------------------------------------------+
| Packet Length | Command | Command Id | Command response required | CorrelationId |
|---------------|---------|------------|---------------------------|---------------|
| 00000066 | 1f | 00000000 | 00 | 00000000 |
+----------------------------------------------------------------------------------+
Packet Body
+--------------------------------------------------------------------------------------+
| not-null | not-null | classname-size | classname | not-null | message-size | message |
|----------|----------|----------------|-----------|----------|--------------|---------|
| 01 | 01 | 0043 | ..... | 01 | 0012 | ..... |
+--------------------------------------------------------------------------------------+
OpenWire Packet Body Format
[=If not-null is 1===========]
+----------+ [ +-------+----------------+ ]
| not-null | [ | size | encoded-string | ]
+----------+ [ +-------+----------------+ ]
| byte | [ | short | size octects | ]
+----------+ [ +-------+----------------+ ]
[============================]
[Figure 1] Wireshark OpenWire packet check
[Figure 2] Meaning of Packet Header
Breaking Down the Packet Header
+----------------------------------------------------------------------------------+
| Packet Length | Command | Command Id | Command response required | CorrelationId |
|---------------|---------|------------|---------------------------|---------------|
| 00000066 | 1f | 00000000 | 00 | 00000000 |
+----------------------------------------------------------------------------------+
Packet Length : 00000066 / Protocols like OpenWire specify the packet length.
Command : 1f / is set to specify ExecptionResponse (31); 31 in hexadecimal (hex) is 1f.
Command Id : 00000000 / is a 4-byte integer, so in hexadecimal it is 00 00 00 00.
Command response required : 00 / is a boolean type; False (00) from True (01), False (00).
CorrelationId : Same type as Command Id.
[Figure 2] adds explanations about the format of each header item and the assigned code to help understand the packet header above. Now that we have looked at the Header, let's see how it passes through the code via the Body contents.
[Figure 3] Meaning of Packet Body
not-null (01) | / passes not-null check in the first function of [Figure 3] not-null (01) | classname-size (0043) | classname / passes not-null check in the second function of [Figure 3], for size check in the third function not-null (01) | message-size (0012) | message / passes not-null check in the second function of [Figure 3], for size check in the third function
[Figure 3] shows how the values set in the Body of the packet work. Finally, through [Figure 4], the serialized data is used to load and instantiate a class.
<p align="center"> <img src="https://assets.kitploit.com/production/public/readmes/32661/ca50c208f8505bc49c7f0db58bcf2b8b19eb89d979afed4093f955f5bc35bebf.png" alt="image description"> </p>
<p align="center">[Figure 4] RCE Execution via createThrowable </p>
<p align="center"> <img src="https://assets.kitploit.com/production/public/readmes/32661/7d82ac3f7425dd05b74c69cf696270387493fbfddf15277c6ed32a35aa9f6f36.gif" alt="image description"> </p>
<p align="center">[Figure 5] RCE Calculator Execution Example </p>
<p align="center"> <img src="https://assets.kitploit.com/production/public/readmes/32661/9459a15f46112355ce29fdf436c3af25b2180317975eedfceed965ef006db761.png" alt="image description"> </p>
<p align="center">[Figure 5] Git Diff (5.17.2 -> 5.17.6) </p>
<p align="center"> <img src="https://assets.kitploit.com/production/public/readmes/32661/11cd8daf7e06ba6db114c26b86759e88213ca7a9ba2aad6c7dcd5ec791cd6a2b.png" alt="image description"> </p>
<p align="center">[Figure 5] validate Function </p>
## 03. Conclusion
Unlike other analyses, the reason we analyzed the attack packet for this vulnerability was to understand and study how the attack actually works.
By closely examining the structure and flow of the packet, we were able to clearly understand the specific methods used by attackers to compromise the system and their operating mechanism.
## 04. References
(nist) https://nvd.nist.gov/vuln/detail/cve-2023-46604
(POC) https://github.com/X1r0z/ActiveMQ-RCE/tree/main
(blog) https://attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604/rapid7-analysis