Back to all use cases

CVE PatchingIndustrial / Manufacturing

A remote code execution flaw on a port the plants could all reach

Industrial Equipment Manufacturer

A manufacturer with ActiveMQ Classic brokers at plants and in the cloud had no inventory of versions or clients when CVE-2023-46604 landed. AceMQ contained it, found what was exposed, and patched brokers and clients.

Overview

CVE-2023-46604 is a remote code execution flaw in the Java OpenWire marshaller, affecting ActiveMQ brokers and Java clients alike. A manufacturer ran Classic brokers at several plants and in its cloud accounts, installed by different teams over the years. Nobody could say how many there were, which versions they ran, or which networks could reach the OpenWire port.

Challenge

Versions ranged from 5.14 to 5.18, and 5.14 has no fix line of its own, so those brokers had to move to a newer release. Plant networks were flat, so the OpenWire port was reachable from far more hosts than the broker's real clients. The flaw also affects clients, and several applications carried an ActiveMQ client library inside a fat jar, which no broker upgrade would touch. Production lines allowed only short change windows.

Environment

A mixed estate of ActiveMQ Classic 5.14 to 5.18 brokers on Linux hosts and in containers, across plant data centres and cloud accounts, with Java applications and gateways as clients.

Approach

AceMQ contained first and patched second. Network restrictions on the OpenWire port went in the same day, then an inventory of brokers and clients, then a check for signs of exploitation, then upgrades in order of exposure. Clients followed brokers, with each change tested against a staging copy of the plant's integration.

Solution

  1. Restricted the OpenWire port on every broker to the addresses of its known clients before any upgrade
  2. Built the inventory of broker versions from JMX and of client library versions by scanning application images and fat jars
  3. Checked each broker for signs of exploitation: unexpected child processes of the broker JVM, outbound connections from broker hosts, and remote configuration loads in the logs
  4. Upgraded brokers to the fixed release of their line, 5.15.16, 5.16.7, 5.17.6 or 5.18.3, and tested failover after each
  5. Replaced the vulnerable client libraries inside applications and rebuilt the affected images
  6. Turned on authentication and TLS for transport connectors, and added version and advisory monitoring so the next ActiveMQ CVE reaches the owner of each broker

Outcome

Every broker ran a fixed release, the OpenWire port was reachable only from listed clients, and the review found no signs of compromise. The manufacturer now has a current inventory of ActiveMQ brokers and client libraries, with a named owner for each.

Technologies

ActiveMQJavaLinuxDocker

Related Reading

Have an ActiveMQ Challenge Like This?

AceMQ's senior ActiveMQ engineers have handled this exact type of engagement before. Whether you need architectural guidance, hands-on remediation, or an ongoing managed partnership, we're ready to help.