CVE-2024-23321 Apache RocketMQ: Unauthorized Exposure of Sensitive Data
An attacker with regular user privileges can expose administrator credentials, leading to full control of the Apache RocketMQ server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23321?
CVE-2024-23321 is a high-severity vulnerability in Apache RocketMQ, published on 22 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions.
An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list.
To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0.
Weakness: CWE-200
Which versions are affected by CVE-2024-23321?
2 open source packages ship an affected version, including org.apache.rocketmq:rocketmq-all. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.rocketmq:rocketmq-all Maven | From 4.5.2 | 5.3.0 |
org.apache.rocketmq:rocketmq-all Maven | From 4.5.2 | 5.3.0 |
Products include Apache Rocketmq.
How do I fix CVE-2024-23321?
Upgrade org.apache.rocketmq:rocketmq-all to 5.3.0 or later.
Is CVE-2024-23321 being exploited?
There is no known exploitation of CVE-2024-23321 in the wild and no public exploit code.
Other vulnerabilities in Apache RocketMQ
Sources
Also known as GHSA-q9w2-h4cw-8ghp.