Hackers are actively exploiting a critical vulnerability (CVE-2023-46604) in Apache ActiveMQ, targeting Linux systems with the Kinsing malware to deploy a crypto mining script. According to Trend Micro researchers, the flaw in the open-source ActiveMQ protocol allows for remote code execution (RCE), facilitating the download and installation of malware by Kinsing. Once a system is infected, Kinsing unleashes a cryptocurrency mining script, leveraging the host's resources to mine digital currencies like Bitcoin. This not only results in significant infrastructure damage but also severely impacts system performance.
The Kinsing malware poses a substantial threat, particularly focusing on Linux-based systems, and exhibits the capability to infiltrate servers while rapidly spreading through networks. Its mode of entry involves exploiting vulnerabilities in web applications or misconfigured container environments.
In response to the escalating threat, organizations utilizing Apache ActiveMQ are strongly advised to take immediate action to patch CVE-2023-46604 and mitigate the associated risks linked with Kinsing. The researchers emphasize the importance of maintaining up-to-date security patches, regularly auditing configurations, and monitoring network traffic for any unusual activity. These measures are deemed critical components of a comprehensive cybersecurity strategy.
The vulnerability's root cause is identified in a validation problem related to throwable class types during the unmarshalling of OpenWire commands, as highlighted by the researchers. Despite the severity of the vulnerability, rated at CVSS 9.8, the level of detection remains relatively low.
Reports earlier this month revealed active exploitation of CVE-2023-46604 by hackers utilizing exploits like Metasploit and Nuclei. John Gallagher, Vice President of Viakoo Labs, underscores the significance of the CVE, noting the widespread use of Apache ActiveMQ across multiple protocols and its extensive utilization in non-IT environments for interfacing with IoT/OT/ICS devices.
Gallagher emphasizes the challenges organizations face in maintaining the patching of IoT devices, making them ideal targets for activities like crypto mining. Kinsing strategically exploits this vulnerability, anticipating its longevity and aligning with their objective of sustained processing for crypto mining activities.
