How to find Apache ActiveMQ instances


What is Apache ActiveMQ? #

ActiveMQ® is an open source message broker written in Java that supports AMQP, MQTT, STOMP, and JMS clients. Apache ActiveMQ describes itself as "the most popular open source, multi-protocol, Java-based message broker. It supports industry standard protocols so users get the benefits of client choices across a broad range of languages and platforms.". ActiveMQ is used for custom application development and is often embedded into commercial product stacks.

Latest Apache ActiveMQ vulnerability #

On October 25th the Apache team announced a vulnerability (CVE-2023-46604) in ActiveMQ that could lead to unauthenticated remote code execution. Shortly after the issue was disclosed exploits started to appear and the Rapid7 MDR team posted a blog speculating that this vulnerability is being used to deliver ransomware. The Apache ActiveMQ project scored this as CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H(10.0).

Are updates available? #

The Apache ActiveMQ team has addressed this issue in versions 5.18.3, 5.17.6, 5.16.7, and 5.15.16, with the appropriate update dependent on which minor version is used.

How do I find potentially vulnerable versions of ActiveMQ with runZero? #

Apache ActiveMQ services can be found by navigating to the Asset Inventory and using the following query:

port:61616 OR product:activemq OR protocol:activemq

Results from the above query should be triaged to determine if they require patching or vendor intervention.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Rapid Response
How to find Palo Alto Network firewalls running PAN-OS 11.1, 11.0, and 10.2
Palo Alto Networks disclosed that versions of their PAN-OS software have a vulnerability allowing for remote command injection. Here's how to find...
Rapid Response
How to find outdated lighttpd services
Outdated versions of the open source lighttpd web server are vulnerable to a handful of security vulnerabilities
Rapid Response
How to find D-Link NAS Storage devices
D-Link has disclosed multiple vulnerabilities in their D-Link NAS Storage products. Here's how to find potentially impacted devices.
Rapid Response
How to find Brocade Fabric OS
On April 4, 2024, Broadcom disclosed a vulnerability in their Fabric OS operating system used in their Brocade storage networking devices. Here's...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved