Apache.RocketMQ.updateConfig.Command.Execution

Description

This indicates an attack attempt to exploit a remote Command Execution vulnerability in Apache Software Foundation RocketMQ.
The vulnerability is due to insufficient permission verification in several RocketMQ components, including NameServer, Broker, and Controller. A remote attacker can potentially exploit this vulnerability either by using the update configuration function or forging the RocketMQ protocol content. Successful exploitation could result in arbitrary command execution.

Outbreak Alert

RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands or by forging the RocketMQ protocol content. CVE-2023-33246 is reportedly being exploited in the wild. Additionally, proof-of-concept (PoC) code is publicly available.

View the full Outbreak Alert Report

Affected Products

Apache Software Foundation RocketMQ 4.x.x prior to 4.9.7
Apache Software Foundation RocketMQ 5.x.x prior to 5.1.2

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp