CVE-2023-33246criticalunder attackCWE-94

CVE-2023-33246: critical vulnerability in Apache RocketMQ

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

Published · Updated

Follow this CVE+ Monitor Apache RocketMQ+ Monitor org.apache.rocketmq:rocketmq-broker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon6 days
Published on NVDMay 24
1st PoC+6d
metasploitMay 23
CISA KEV+105d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2023-09-27

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Apache RocketMQ versions 5.1.0 and below allow attackers to execute arbitrary commands on servers running the software. If RocketMQ components are exposed to the internet without proper access controls, an attacker can use the configuration update feature to run malicious commands with the privileges of the RocketMQ system user.

Technical detail

CVE-2023-33246 exploits missing authentication in RocketMQ NameServer, Broker, and Controller components exposed on untrusted networks. An attacker can send crafted RocketMQ protocol messages or abuse the update configuration function (CWE-94: Improper Control of Generation of Code) to achieve remote code execution with the privileges of the RocketMQ process user. Affected versions are RocketMQ 5.1.0 and below (4.x up to 4.9.5).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.  To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache RocketMQ
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache RocketMQ

In the same product, most dangerous first.

CVE-2023-37582CRITICALApache RocketMQ: Possible remote code execution when using the update configuration functionEPSS 90.4%CVE-2024-23321HIGHApache RocketMQ: Unauthorized Exposure of Sensitive DataEPSS 0.9%