Huntress Observes Exploitation of Apache ActiveMQ CVE-2023-46604
Summary
Huntress tied observed commands and installer activity to exploitation of Apache ActiveMQ CVE-2023-46604. It urges users to patch affected versions or block internet access to unpatched systems.
Key points
- Huntress says it observed exploitation of the remote code execution vulnerability in a monitored environment and tied the activity to an incident at a partner.
- The observed process chain ran from ActiveMQ’s wrapper.exe through java.exe to command execution.
- Attackers attempted to download and install MSI files; Huntress reported that these attempts did not appear to succeed.
- Huntress observed agent_w.exe, which Windows Defender quarantined shortly after execution; analysis indicated it attempted to connect to 137.175.17[.]172.
- The demonstrated exploit sends a crafted OpenWire packet, causing the server to fetch a remote class configuration file that can execute commands.
- Patches are available for ActiveMQ versions 5.15.16, 5.16.7, 5.17.6, and 5.18.3. Huntress advises blocking internet access to systems that cannot be patched.
- Huntress released a Sigma detector and added detections for the reported activity.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- If unable to patch, block the systems from being accessible from the Internet.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 137[.]175[.]17[.]172 | Destination the retrieved agent_w.exe file attempted to connect to. |
| IPV4 | 27[.]102[.]128[.]152 | Host from which endpoints made curl requests for the malicious bit[.]ico resource. |
| IPV4 | 4[.]216[.]93[.]211 | Host serving the RuntimeBroker.msi payload. |
| IPV4 | 45[.]32[.]120[.]181 | Host referenced by the retrieved batch file as the source of x86.exe. |
| SHA256 | 4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910 | Hash of the RuntimeBroker.msi payload referenced in the observed download-and-install command. |
| SHA256 | dd13cf13c1fbdc76da63e76adcf36727cfe594e60af0dc823c5a509a13ae1e15 | Hash of the agent_w.exe file that was quarantined after it attempted to connect to a remote host. |
MITRE ATT&CK
T1059.003 · Windows Command ShellObserved commands invoked cmd.exe to run commands and launch downloaded files.T1105 · Ingress Tool TransferCommands attempted to download MSI and executable payloads from remote hosts.T1190 · Exploit Public-Facing ApplicationThe vulnerability was exploited remotely through Apache ActiveMQ.T1543.003 · Windows ServiceThe batch file used sc create to configure a service named windowDefenSrv with automatic startup.
CVE
People
Faith StrattonContributor to the Huntress writeup.Harlan CarveyContributor to the Huntress writeup.Izzy SperingContributor to the Huntress writeup.Joe SlowikContributor to the Huntress writeup.Josh AllmanContributor to the Huntress writeup.Matt AndersonContributor to the Huntress writeup.Matt KielyContributor to the Huntress writeup.Sharon MartinContributor to the Huntress writeup.
Vendors
Products
Tools
exe2msiSetupPackageBoth *.png files were, in fact, MSI installer files packaged using the exe2msiSetupPackage, from QwertyLab, as illustrated in Figure 2.Metasploit FrameworkThere is a Metasploit module that automates exploitation for this attack.Sigma detectorThe Huntress DE&TH team has also released a public Sigma detector for this particular threat.