CVE-2023-33246 Apache RocketMQ Command Execution
Attackers can execute arbitrary commands on Apache RocketMQ servers if components are exposed without authentication, requiring an upgrade to secure versions.
- Exploited in the wild
- Since 6 Sep 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33246?
CVE-2023-33246 is a critical command injection vulnerability in Apache RocketMQ, published on 24 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Weakness: CWE-94
Which versions are affected by CVE-2023-33246?
8 open source packages ship an affected version, including org.apache.rocketmq:rocketmq-namesrv, org.apache.rocketmq:rocketmq-broker and org.apache.rocketmq:rocketmq-controller. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.rocketmq:rocketmq-namesrv Maven | From 4.0.0 | 4.9.6 |
org.apache.rocketmq:rocketmq-namesrv Maven | From 4.0.0 | 4.9.6 |
org.apache.rocketmq:rocketmq-namesrv Maven | From 5.0.0 | 5.1.1 |
org.apache.rocketmq:rocketmq-namesrv Maven | From 5.0.0 | 5.1.1 |
org.apache.rocketmq:rocketmq-broker Maven | From 5.0.0 | 5.1.1 |
org.apache.rocketmq:rocketmq-broker Maven | From 5.0.0 | 5.1.1 |
2 more packages
org.apache.rocketmq:rocketmq-controller Maven | From 5.0.0 | 5.1.1 |
org.apache.rocketmq:rocketmq-controller Maven | From 5.0.0 | 5.1.1 |
Products include Apache Rocketmq.
How do I fix CVE-2023-33246?
Upgrade org.apache.rocketmq:rocketmq-namesrv to a fixed version for your release line: 4.9.6 or 5.1.1. US federal agencies must fix it by 27 Sep 2023.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-33246 being exploited?
Yes. Attackers have exploited CVE-2023-33246 in the wild since at least 6 Sep 2023.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 13 proofs of concept on GitHub.
Other vulnerabilities in Apache RocketMQ
Sources
Also known as GHSA-x3cq-8f32-5f63.