CVE-2023-33246
published 2023-05-24CVE-2023-33246: For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2023-09-27
Exploited in the wild
EPSS
96.60%
99.9th percentile
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | rocketmq | < 4.9.6 | 4.9.6 |
| apache | rocketmq | <= 4.9.6 | — |
| apache | rocketmq | >= 5.0.0 < 5.1.1 | 5.1.1 |
| apache | rocketmq | 5.0.0 – 5.1.1 | — |
| apache_software_foundation | apache_rocketmq | <= 4.9.6 | — |
| apache_software_foundation | apache_rocketmq | 5.0.0 – 5.1.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes
000000a4000000617b22636f6465223a3331382c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3430357d636f6e66696753746f7265506174683d2f746d702f70776e65640a70726f64756374456e764e616d653d746573742f706174685c6e746573745c6e74657374
bytes↗
00 00 00 c8 00 00 00 60 7b 22 63 6f 64 65 22 3a 32 35 ... 72 6f 63 6b 65 74 6d 71 48 6f 6d 65 3d 2d 63 20 24 40 7c 73 68
sigma
matchers: type: dsl; dsl: contains_all(raw, "serializeTypeCurrentRPC", "version", "code\":0") AND !contains_any(raw, 'Can not update config','FORBID ACCESS')
- →Scan for RocketMQ Broker exploitation attempts on TCP port 10911; the exploit payload sets rocketmqHome=-c $@|sh to achieve RCE via the update configuration function. ↗
- →Monitor TCP port 9876 (RocketMQ NameServer) for inbound connections from untrusted external IPs; exposure without authentication enables RCE via the update configuration function. ↗
- →Detect DreamBus RocketMQ exploit module by looking for the lock file /tmp/.systemd.3 on disk; its presence indicates an active DreamBus exploit module instance. ↗
- →Detect DreamBus post-exploitation by monitoring for outbound SOCKS5/TOR connections to relay.tor2socks.in:9050 and the .onion domain ru6r4inkaf4thlgflg4iqs5mhqwqubols5qagspvya4whp3dgbvmyhad. ↗
- →For CVE-2023-33246 / CVE-2023-37582 NameServer exploitation, a successful response will contain 'serializeTypeCurrentRPC', 'version', and 'code":0' but NOT 'Can not update config' or 'FORBID ACCESS'.
- →UPX-packed DreamBus ELF binaries replace the standard UPX magic bytes (0x21585055 / 'UPX!') with '.gnu' (0x756e672e); use this as a static signature to identify DreamBus modules. ↗
- →Monitor for processes named 'httpd' or 'sh' executing from /tmp, /root/.config, /usr/bin, or /usr/lib — these are indicators of the perfctl malware dropped after RocketMQ exploitation. ↗
- →Check /etc/ld.so.preload and watch for a rootkit named 'libgcwrap.so' being loaded; this is deployed by perfctl after initial access via CVE-2023-33246. ↗
- →Inspect ~/.profile, ~/.bashrc, and /etc/ld.so.preload for unauthorized modifications as persistence indicators following exploitation of CVE-2023-33246. ↗
- ·The Shodan query 'rocketmq port:"9876"' can be used to identify internet-exposed RocketMQ NameServer instances potentially vulnerable to CVE-2023-33246/CVE-2023-37582.
- ·The RocketMQ Broker (port 10911) was never intended to be internet-facing; its administrative interface is insecure by design and should be firewalled from public access. ↗
- ·CVE-2023-33246 was only partially fixed in version 5.1.1; the NameServer component remained vulnerable and was separately tracked as CVE-2023-37582, requiring upgrade to 5.1.2/4.9.7 or above. ↗
- ·DreamBus exploit modules scan both internal RFC 1918 ranges and random public IPs, meaning vulnerable RocketMQ instances on internal networks are also at risk if any infected host is present. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache RocketMQ Command Execution Vulnerability
cisa·2023-09-06·CVSS 9.8
CVE-2023-33246 [CRITICAL] CWE-94 Apache RocketMQ Command Execution Vulnerability
Vulnerability: Apache RocketMQ Command Execution Vulnerability
Affected: Apache RocketMQ
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp; https://nvd.nist.gov/vuln/detail/CVE-2023-33246
Remediation Due Date: 2023-09-27
Red Hat
rocketmq: Apache RocketMQ Arbitrary Code Injection
vendor_redhat·2023-05-24·CVSS 9.8
CVE-2023-33246 [CRITICAL] CWE-94 rocketmq: Apache RocketMQ Arbitrary Code Injection
rocketmq: Apache RocketMQ Arbitrary Code Injection
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
A vulnerability was found in Apache RocketMQ where, under certain conditions, there is a risk of
GHSA
RocketMQ NameServer component Code Injection vulnerability
ghsa·2023-07-12·CVSS 9.8
CVE-2023-37582 [CRITICAL] CWE-94 RocketMQ NameServer component Code Injection vulnerability
RocketMQ NameServer component Code Injection vulnerability
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.
It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
OSV
RocketMQ NameServer component Code Injection vulnerability
osv·2023-07-12·CVSS 9.8
CVE-2023-37582 [CRITICAL] RocketMQ NameServer component Code Injection vulnerability
RocketMQ NameServer component Code Injection vulnerability
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.
It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
OSV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
osv·2023-07-06
CVE-2023-33246 [CRITICAL] Apache RocketMQ may have remote code execution vulnerability when using update configuration function
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
GHSA
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
ghsa·2023-07-06
CVE-2023-33246 [CRITICAL] CWE-94 Apache RocketMQ may have remote code execution vulnerability when using update configuration function
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
VulnCheck
Apache RocketMQ Command Execution Vulnerability
vulncheck·2023·CVSS 9.8
CVE-2023-33246 [CRITICAL] CWE-94 Apache RocketMQ Command Execution Vulnerability
Apache RocketMQ Command Execution Vulnerability
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Affected: Apache RocketMQ
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://blogs.juniper.net/en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability; https://vulncheck.com/blog/rocketmq-exploit-payloads; https://www.cisa.gov/sites/default/files/
VulnCheck
Apache rocketmq Improper Control of Generation of Code ('Code Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-37582 [CRITICAL] Apache rocketmq Improper Control of Generation of Code ('Code Injection')
Apache rocketmq Improper Control of Generation of Code ('Code Injection')
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.
It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Affected: Apache rocketmq
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if
Suricata
ET WEB_SPECIFIC_APPS Apache RocketMQ 5.1.0 Arbitrary Code Injection in Broker Config (CVE-2023-33246)
suricata·2023-09-07·CVSS 9.8
CVE-2023-33246 [CRITICAL] ET WEB_SPECIFIC_APPS Apache RocketMQ 5.1.0 Arbitrary Code Injection in Broker Config (CVE-2023-33246)
ET WEB_SPECIFIC_APPS Apache RocketMQ 5.1.0 Arbitrary Code Injection in Broker Config (CVE-2023-33246)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET [10909,10911] (msg:"ET WEB_SPECIFIC_APPS Apache RocketMQ 5.1.0 Arbitrary Code Injection in Broker Config (CVE-2023-33246)"; flow:established,to_client; file.data; content:"rocketmqHome|3d 2d|c|20 24 40 7c|sh|20 2e 20|echo|20|"; fast_pattern; content:"|3b|"; distance:0; reference:url,vulncheck.com/blog/rocketmq-exploit-payloads; reference:url,blogs.juniper.net/en-us/threat-research/cve-2023-33246-apache-rocketmq-remote-code-execution-vulnerability; reference:url,packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html; reference:url,attackerkb.com/topics/YBI7e7fY0a/cve-2023-33246; reference:cve,2023-33246; clas
Nuclei
Apache RocketMQ - Remote Command Execution
nuclei·CVSS 9.8
CVE-2023-37582 [CRITICAL] Apache RocketMQ - Remote Command Execution
Apache RocketMQ - Remote Command Execution
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Template:
id: CVE-2023-37582
info:
name: Apache RocketMQ - Remote Command Execution
author: daffainfo
severity: critical
description: |
The RocketMQ NameServer component
Metasploit
Apache RocketMQ update config RCE
metasploit
Apache RocketMQ update config RCE
Apache RocketMQ update config RCE
RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
Nuclei
RocketMQ <= 5.1.0 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2023-33246 [CRITICAL] RocketMQ <= 5.1.0 - Remote Code Execution
RocketMQ <= 5.1.0 - Remote Code Execution
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Template:
id: CVE-2023-33246
info:
name: RocketMQ <= 5.1.0 - Remote Code Execution
author: iamnoooob,ro
Schneier
Perfectl Malware
blogs_schneier·2024-10-14·CVSS 9.8
CVE-2023-33246 [CRITICAL] Perfectl Malware
## Perfectl Malware
Perfectl in an impressive piece of malware:
The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines.
The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation common
Bleepingcomputer
Linux malware “perfctl” behind years-long cryptomining campaign
blogs_bleepingcomputer·2024-10-03·CVSS 7.8
CVE-2023-33246 [HIGH] Linux malware “perfctl” behind years-long cryptomining campaign
## Linux malware “perfctl” behind years-long cryptomining campaign
## Bill Toulas
The researchers have also observed exploitation of CVE-2023-33246 , a remote command execution impacting Apache RocketMQ versions 5.1.0 and older, and CVE-2021-4034 (PwnKit), an elevation of privilege flaw in Polkit.
Once initial access is established, the packed and obfuscated payload, named "httpd," is downloaded from the attacker's server and executed. It then copies itself in the /tmp directory under the "sh" name and then deletes the original binary.
The new process assumes the same name ("sh"), essentially blending with normal Linux system operations.
Additional copies are created in other system locations, such as "/root/.config," "/usr/bin/" and "usr/lib" to ensure persistence in the case of a cl
Wiz
Crying Out Cloud - February Newsletter | Wiz
blogs_wiz·2024-02-01·CVSS 9.8
CVE-2023-33246 [CRITICAL] Crying Out Cloud - February Newsletter | Wiz
This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Let's dive in.
Here are our top picks!
## 🐞 High Profile Vulnerabilities
Apache RocketMQ RCE vulnerability exploited in-the-wild
In August 2023 researchers identified attackers exploiting CVE-2023-33246, a critical vulnerability in Apache RocketMQ, to install the DreamBus bot, a malware strain last reported about publicly in 2021. On January 5, 2024 Apache stated that the patch for CVE-2023-33246 was in fact insufficient, and an additional CVE was assigned to the bypass - CVE-2023-37582. The latter vulnerability is also being exploited in the wild, so it is recommended to patc
Zscaler
DreamBus | ThreatLabz
blogs_zscaler·2024-01-11
DreamBus | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bleepingcomputer
Hackers target Apache RocketMQ servers vulnerable to RCE attacks
blogs_bleepingcomputer·2024-01-05·CVSS 9.8
CVE-2023-33246 [CRITICAL] Hackers target Apache RocketMQ servers vulnerable to RCE attacks
## Hackers target Apache RocketMQ servers vulnerable to RCE attacks
## Bill Toulas
Security researchers are detecting hundreds of IP addresses on a daily basis that scan or attempt to exploit Apache RocketMQ services vulnerable to a remote command execution flaw identified as CVE-2023-33246 and CVE-2023-37582.
Both vulnerabilities have a critical severity score and refer to an issue that remained active after the vendor's initial patch in May 2023.
Initially, the security issue was tracked as CVE-2023-33246 and impacted multiple components, including NameServer, Broker, and Controller.
Apache released a fix that was incomplete for the NameServer component in RocketMQ and continued to affect versions 5.1 and older of the distributed messaging and streaming platform.
"The RocketMQ Name
Bleepingcomputer
CISA warns of critical Apache RocketMQ bug exploited in attacks
blogs_bleepingcomputer·2023-09-07·CVSS 9.8
CVE-2023-33246 [CRITICAL] CISA warns of critical Apache RocketMQ bug exploited in attacks
## CISA warns of critical Apache RocketMQ bug exploited in attacks
## Ionut Ilascu
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added to its catalog of known exploited vulnerabilities (KEV) a critical–severity issue tracked as CVE-2023-33246 that affects Apache’s RocketMQ distributed messaging and streaming platform.
Multiple threat actors are possibly exploiting the vulnerability at the moment to install various payloads on impacted systems (RocketMQ versions 5.1.0 and below).
Exploiting the vulnerability is possible without authentication and has been leveraged in the wild since at least June by operators of the DreamBus botnet to deploy a Monero cryptocurrency miner.
## Design flaw
CISA is warning federal agencies that they should patch the CVE-2023-33246 v
Wiz
Crying Out Cloud - August Newsletter | Wiz
blogs_wiz·2023-08-30·CVSS 6.5
[MEDIUM] Crying Out Cloud - August Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's delve in.
Editor’s note: some of you may have noticed that we accidentally resent last month’s edition (July) – this was due to a technical issue for which we apologize.
Moving on – here are our top picks of cloud security highlights!
## 🐞 High Profile Vulnerabilities
## High severity vulnerabilities in Kubernetes on Windows nodes
Three high severity Kubernetes vulnerabilities were published on August 23. All three are flaws related to insufficient sanitization that could lead to privilege escalation. Kubernetes clusters are only affected by these vulnerabilities if they include Windows nodes. The vulnerabilities were assigned CVE-2023-3676
http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.htmlhttp://www.openwall.com/lists/oss-security/2023/07/12/1https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyphttp://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.htmlhttp://www.openwall.com/lists/oss-security/2023/07/12/1https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyphttps://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIThttps://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCEhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
2023-05-24
Published
2023-09-06
Added to CISA KEV
Exploited in the wild