CVE-2023-33246: Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Other sources
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
— CISA
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for the Apache RocketMQ command execution vulnerability?
The vulnerability ID for the Apache RocketMQ command execution vulnerability is CVE-2023-33246.
How severe is the Apache RocketMQ command execution vulnerability?
The Apache RocketMQ command execution vulnerability is classified as critical with a severity value of 9.
Which versions of RocketMQ are affected by the command execution vulnerability?
RocketMQ versions 5.1.0 and below are affected by the command execution vulnerability.
What is the risk associated with the Apache RocketMQ command execution vulnerability?
The Apache RocketMQ command execution vulnerability poses a risk of remote command execution.
How can the Apache RocketMQ command execution vulnerability be exploited?
The vulnerability can be exploited by an attacker by using leaked and unverified components of RocketMQ, such as NameServer, Broker, and Controller.