Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

Apache RocketMQ versions 5.1.0 and below allow attackers to execute arbitrary commands on servers running the software. If RocketMQ components are exposed to the internet without proper access controls, an attacker can use the configuration update feature to run malicious commands with the privileges of the RocketMQ system user.

CVE-2023-33246 exploits missing authentication in RocketMQ NameServer, Broker, and Controller components exposed on untrusted networks. An attacker can send crafted RocketMQ protocol messages or abuse the update configuration function (CWE-94: Improper Control of Generation of Code) to achieve remote code execution with the privileges of the RocketMQ process user. Affected versions are RocketMQ 5.1.0 and below (4.x up to 4.9.5).