This repository is a guide with examples on how to exploit the CVE-2023-46604
The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command that instead of being a valid command, it sends as the exception class a Spring class to load beans and as the string constructor parameter an URL from where to download an XML file with the Spring Bean definitions.
This Spring Bean is in fact a java.lang.ProcessBuilder which will run any bash command with the same user permissions as the
one that is running the Java Active MQ client or server.