CVE-2023-37582 Apache RocketMQ: Possible remote code execution when using the update configuration function

What is CVE-2023-37582?

CVE-2023-37582 is a critical command injection vulnerability in Apache RocketMQ, published on 12 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.

Weakness: CWE-94

Which versions are affected by CVE-2023-37582?

4 open source packages ship an affected version, including org.apache.rocketmq:rocketmq-namesrv. It affects 1 product.

Products include Apache Rocketmq.

How do I fix CVE-2023-37582?

Upgrade org.apache.rocketmq:rocketmq-namesrv to a fixed version for your release line: 4.9.7 or 5.1.2.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-37582 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37582 exists.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in Apache RocketMQ

• CVE-2023-33246 Apache RocketMQ Command Execution Exploited Critical 9.8
• CVE-2024-23321 Apache RocketMQ: Unauthorized Exposure of Sensitive Data High 7.5
• CVE-2019-17572 Directory traversal in Apache RocketMQ Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gpq8-963w-8qc9.