RCE in Apache Rocketmq
CVE-2023-33246
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.966 (99.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Rocketmq
- Apache Software Foundation Rocketmq — versions 0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- security@apache.org (Exploit, VDB Entry, Third Party Advisory)
- security@apache.org (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Exploit, Third Party Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Third Party Advisory, US Government Resource)
Frequently asked questions
- What is CVE-2023-33246?
- CVE-2023-33246 is a critical-severity vulnerability in Apache Rocketmq, classified under Code Injection. CVSS score: 9.8/10. Published 2023-05-24.
- How severe is CVE-2023-33246?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-33246 known to be exploited?
- Yes. CVE-2023-33246 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-09-06), indicating it is being actively exploited. 72 public proof-of-concept repositories are indexed.