Apache RocketMQ: Possible remote code execution when using the update configuration function
CVE-2023-37582

9.8CRITICAL

Key Information:

Vendor: Apache
Status: Apache RocketMQ
Vendor: CVE Published:; 12 July 2023

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

The RocketMQ NameServer component is affected by a persistent remote command execution vulnerability. This issue arises when NameServer addresses are improperly exposed on the extranet without adequate permission verification. Attackers can leverage this flaw to exploit the update configuration function, potentially executing arbitrary commands as the system users under which RocketMQ operates. Users are strongly advised to upgrade their NameServer to version 5.1.2 or later for RocketMQ 5.x and to version 4.9.7 or later for RocketMQ 4.x to mitigate these risks.

Affected Version(s)

Apache RocketMQ 5.0.0 <= 5.1.1

Apache RocketMQ 0 <= 4.9.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-37582_EXPLOIT
Created by Malayke