vaishnavucv/project-vuln-detection-n-mitigation_101Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization Remote Code Execution (RCE) – CVE-2023-46604
Security Architectures & Systems Administration
Author: [Vaishnavu C V] · Date: 17 Sep 2025
Status: ⌀ Phase 2 deliverables complete
This repository documents a hands‑on security design project focused on CVE‑2023‑46604 in Apache ActiveMQ (Classic). It includes a clear explanation of the vulnerability, deep‑dive technical notes, impact assessment, affected systems, detection and mitigation designs, and a consolidated design report suitable for university submission.
→→ Phase 2 Design Report (single file) → phase_2_design_report.md
→→
phase_2_intro.mdphase_2_vulnerability_explanation.mdphase_2_technical_detail.mdphase_2_impact.mdphase_2_affected_systems.mdphase_2_detection_design.mdphase_2_mitigation_design.mdphase_2_conclusion.mdphase_2_references.md.
├── phase_2_design_report.md
├── phase_2_intro.md
├── phase_2_vulnerability_explanation.md
├── phase_2_technical_detail.md
├── phase_2_impact.md
├── phase_2_affected_systems.md
├── phase_2_detection_design.md
├── phase_2_mitigation_design.md
├── phase_2_conclusion.md
└── phase_2_references.md
flowchart LR
A[Internet attacker] -->|OpenWire 61616<br/>malicious serialized payload| B[(ActiveMQ Broker)]
A -->|Scanning and recon| F[Firewall and ACLs]
F --> B
B -->|Traffic mirror or syslog| C[IDS or IPS Suricata Snort]
B -->|Conn logs| D[Zeek anomaly logs]
B -->|App logs| E[ActiveMQ logs]
C -->|Alert| J[(SIEM)]
D -->|Alert| J
E -->|Alert| J
J -->|Correlation and auto action| G[Fail2ban auto ban]
G -. block .- F
H[Container sandbox non root AppArmor] --- B
I[Protocol restriction disable OpenWire] --- B
classDef detect fill:#eef7ff,stroke:#82b1ff,color:#0a3d62;
classDef ctrl fill:#eefbee,stroke:#6bbf59,color:#0a3d62;
classDef siem fill:#fff7e6,stroke:#f5a623,color:#6b3e00;
class C,D,E detect;
class F,G,H,I ctrl;
class J siem;Read the Single‑File Report: If you’re reviewing for assessment, start with phase_2_design_report.md.
Deep‑dive by Section: Use the modular files listed above to review specific parts (e.g., directly jump to Detection or Mitigation).
Recreate the Lab (Optional):
→→ Safety Note: Any exploitation steps must be performed only in a lawful, controlled lab, never on production or systems you do not own/operate.
Vulnerability Explanation (4 marks) → phase_2_vulnerability_explanation.md
Detection + Mitigation Design (6 marks) → phase_2_detection_design.md and phase_2_mitigation_design.md
Criteria (applicability, practicality, originality, feasibility, clarity) are addressed via:
This educational content is provided for academic, non‑commercial use. Follow your institution’s policies and local laws.