Port reference
Port 61613 (TCP) – STOMP (ActiveMQ)
Default port for STOMP, the Simple Text Oriented Messaging Protocol, commonly enabled on Apache ActiveMQ brokers.
Default state
When the STOMP connector is enabled, ActiveMQ listens on 61613. With default admin/admin credentials or anonymous access, exposed brokers allow reading and injecting messages.
Common attacks
- Login with default ActiveMQ credentials over STOMP
- Subscribing to queues/topics to read message traffic
- Injecting messages into application destinations
- Pivot to the OpenWire broker on 61616 (e.g. CVE-2023-46604 RCE)
Hardening
- Change default admin/admin credentials and disable anonymous access
- Disable the STOMP connector if it is not required
- Use STOMP over TLS (commonly 61614) instead of plaintext 61613
- Bind to a private interface and firewall 61613 to trusted hosts
- Apply per-user destination authorization and keep ActiveMQ patched
nmap snippet
nmap -p61613 --script banner <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 61613?
Port 61613 is the default for STOMP, the Simple Text Oriented Messaging Protocol, a human-readable framing commonly enabled on Apache ActiveMQ brokers. Clients connect over a simple text protocol to subscribe to and send messages on destinations (queues and topics), making it easy to integrate across languages. The TLS variant typically runs on 61614, and ActiveMQ's main wire protocol, OpenWire, on 61616.
Why it matters for security
STOMP gives direct access to the broker's messages, so an exposed 61613 lets attackers read and inject traffic that drives applications. ActiveMQ may accept default admin/admin credentials or anonymous connections, and plaintext STOMP is unencrypted. An open 61613 also signals an ActiveMQ host likely exposing the OpenWire broker on 61616, target of RCE CVE-2023-46604.
How it's attacked
Attackers connect over STOMP and try default credentials, then subscribe to destinations to read message traffic and send messages into application destinations to influence services. Discovery of 61613 also prompts a pivot to 61616 to attempt CVE-2023-46604 for unauthenticated remote code execution.
Hardening checklist
Change default admin/admin credentials and disable anonymous access. Disable the STOMP connector if it is not required, and use STOMP over TLS (commonly 61614) instead of plaintext 61613. Bind to a private interface and firewall 61613 to trusted hosts, apply per-user destination authorization, and keep ActiveMQ patched. Use the nmap snippet above to check exposure on hosts you are authorized to test.
Related ports
Frequently asked questions
- What is STOMP on port 61613?
- STOMP is the Simple Text Oriented Messaging Protocol, a human-readable framing for messaging often enabled on Apache ActiveMQ. Plaintext 61613 lets clients connect and exchange messages; the TLS variant typically uses 61614.
- Is port 61613 affected by CVE-2023-46604?
- CVE-2023-46604 targets the OpenWire protocol on 61616, not STOMP. But an open 61613 indicates an ActiveMQ broker that likely also exposes the vulnerable 61616, so patch and firewall both.