CVE-2023-37582: Apache RocketMQ: Possible remote code execution when using the update configuration function
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.
It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.rocketmq:rocketmq-namesrvto a version that resolves this vulnerability.Fixed in 5.1.2 - Upgrade
Upgrade
maven/org.apache.rocketmq:rocketmq-namesrvto a version that resolves this vulnerability.Fixed in 4.9.7 - Upgrade
Upgrade
Apache RocketMQ NameServerto a version that resolves this vulnerability.Fixed in 5.1.2 - Upgrade
Upgrade
Apache RocketMQ NameServerto a version that resolves this vulnerability.Fixed in 4.9.7
Event History
Frequently Asked Questions
What is CVE-2023-37582?
CVE-2023-37582 is a vulnerability in Apache RocketMQ that allows for possible remote code execution when using the update configuration.
How severe is CVE-2023-37582?
CVE-2023-37582 has a severity rating of critical.
Which software versions are affected by CVE-2023-37582?
Versions 5.0.0 to 5.1.1 of Apache RocketMQ and versions up to 4.9.6 are affected by CVE-2023-37582.
How can I fix CVE-2023-37582?
To fix CVE-2023-37582, update Apache RocketMQ to version 5.1.2 or later.
Where can I find more information about CVE-2023-37582?
You can find more information about CVE-2023-37582 on the Apache mailing list, Openwall mailing list, and NIST Vulnerability Database.