By 
Cybersecurity researchers are warning of a rise in attacks exploiting a now-patched flaw in Apache ActiveMQ to deliver a malicious code that borrows the code from the open-source web shell Godzilla.
According to the Trustwave researchers, the web shells are concealed within an unknown binary format and are designed to evade security and signature-based scanners. Once deployed the ActiveMQ's JSP engine continues to compile and execute the web shell.
CVE-2023-46604 (CVSS score: 10.0) is a severe vulnerability in Apache ActiveMQ that enables remote code execution. It was actively exploitation by multiple adversaries to deploy ransomware, rootkits, cryptocurrency miners, and DDoS botnets since its public disclosure in Oct 2023.
Apache ActiveMQ is an open-source message broker software that serves as a message-oriented middleware (MOM) platform. It is developed by the Apache Software Foundation and written in Java.
In the latest intrusion set, susceptible instances have been targeted by JSP-based web shells that are planted within the "admin" folder of the ActiveMQ installation directory.
The web shell, named Godzilla, is a functionality-rich backdoor capable of parsing inbound HTTP POST requests, executing the content, and returning the results in the form of an HTTP response.
Security researcher Rodel Mendrez stated that these malicious files are noteworthy because of how the JSP code appears to be concealed within an unknown type of binary. This method has the potential to circumvent security measures, evading detection by security endpoints during scanning.
A closer examination of the attack chain shows that the web shell code is converted into Java code prior to its execution by the Jetty Servlet Engine.
The JSP payload allows the threat actor to connect to the web shell through the Godzilla management user interface and gain complete control over the target host.
The Godzilla Web Shell supports multiple functionalities such as execution of arbitrary shell commands, viewing network information, and handling file management operations.
The Apache ActiveMQ users are recommended to update to the latest version as soon as possible to mitigate potential threats.
