CVE-2023-46604 PoC — Apache ActiveMQ 代码问题漏洞

Description

Repository to exploit CVE-2023-46604 reported for ActiveMQ

介绍

# Active MQ CVE-2023-46604 exploit

This repository is a guide with examples on how to exploit the [CVE-2023-46604](https://activemq.apache.org/news/cve-2023-46604)

The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command
that instead of being a valid command, it sends as the exception class a Spring class to load beans and as the
string constructor parameter an URL from where to download an XML file with the Spring Bean definitions.

This Spring Bean is in fact a `java.lang.ProcessBuilder` which will run any bash command with the same user permissions as the
one that is running the Java Active MQ client or server.

文件快照

备注