CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability
First published: Wed May 24 2023(Updated: )
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache RocketMQ | <5.1.1 | |
| maven/org.apache.rocketmq:rocketmq-namesrv | >=5.0.0<5.1.1 | 5.1.1 |
| maven/org.apache.rocketmq:rocketmq-controller | >=5.0.0<5.1.1 | 5.1.1 |
| maven/org.apache.rocketmq:rocketmq-namesrv | >=4.0.0<4.9.6 | 4.9.6 |
| maven/org.apache.rocketmq:rocketmq-broker | >=5.0.0<5.1.1 | 5.1.1 |
| Apache RocketMQ | <4.9.7 | |
| Apache RocketMQ | >=5.0.0<5.1.2 | |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
- http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
- http://www.openwall.com/lists/oss-security/2023/07/12/1
- https://nvd.nist.gov/vuln/detail/CVE-2023-33246
- https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
- https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
- https://github.com/advisories/GHSA-x3cq-8f32-5f63 (Advisory)
- https://www.theregister.com/2024/02/08/rust_software_memory_safety/
- https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp;
- https://www.bleepingcomputer.com/news/security/linux-malware-perfctl-behind-years-long-cryptomining-campaign/
Frequently Asked Questions
What is the vulnerability ID for the Apache RocketMQ command execution vulnerability?
The vulnerability ID for the Apache RocketMQ command execution vulnerability is CVE-2023-33246.
How severe is the Apache RocketMQ command execution vulnerability?
The Apache RocketMQ command execution vulnerability is classified as critical with a severity value of 9.
Which versions of RocketMQ are affected by the command execution vulnerability?
RocketMQ versions 5.1.0 and below are affected by the command execution vulnerability.
What is the risk associated with the Apache RocketMQ command execution vulnerability?
The Apache RocketMQ command execution vulnerability poses a risk of remote command execution.
How can the Apache RocketMQ command execution vulnerability be exploited?
The vulnerability can be exploited by an attacker by using leaked and unverified components of RocketMQ, such as NameServer, Broker, and Controller.
- collector/nvd-latest
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-x3cq-8f32-5f63
- alias/CVE-2023-33246
- collector/github-advisory
- agent/type
- agent/weakness
- agent/remedy
- agent/title
- agent/description
- collector/the-register
- source/The Register
- alias/CVE-2023-22515
- alias/CVE-2023-34362
- zeroday/true
- agent/news-ai
- agent/severity
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/tags
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2021-4034
- alias/CVE-2021-4043
- vendor/apache
- canonical/apache rocketmq
- package-manager/maven
- version/apache rocketmq/5.0.0