Cybersecurity researchers are issuing a warning about a concerning rise in threat actor activity exploiting a recently patched flaw in Apache ActiveMQ. The exploited vulnerability, CVE-2023-46604, carries a severe CVSS score of 10.0, enabling threat actors to achieve remote code execution. Trustwave reports that the attackers are deploying the Godzilla web shell on compromised hosts, cleverly concealing it within an unknown binary format to evade security measures and signature-based scanners. Despite the uncharted file format, the ActiveMQ’s JSP engine continues to compile and execute the web shell.
The actively exploited flaw, disclosed in late October 2023, has become a favored tool for adversaries engaging in malicious activities such as deploying ransomware, rootkits, cryptocurrency miners, and DDoS botnets. In the observed intrusion sets, susceptible instances of ActiveMQ are targeted with JSP-based web shells planted in the “admin” folder of the installation directory. The Godzilla web shell, recognized for its functionality-rich backdoor capabilities, parses inbound HTTP POST requests, executes content, and returns results through an HTTP response. The unique concealment method of JSP code within an unknown binary poses a challenge for security measures, potentially allowing the malicious files to bypass detection during scanning.
A closer examination reveals that the attack chain involves the conversion of web shell code into Java code before execution by the Jetty Servlet Engine. This JSP payload empowers threat actors to connect to the web shell through the Godzilla management user interface, gaining complete control over the target host. This control facilitates the execution of arbitrary shell commands, retrieval of network information, and handling file management operations. To mitigate these potential threats, users of Apache ActiveMQ are strongly advised to promptly update to the latest version, fortifying their systems against the evolving landscape of cyber exploits.
