CVE-2023-33246
Apache RocketMQ Command Execution Vulnerability
Description
CVE-2023-33246 is a critical remote code execution vulnerability in Apache RocketMQ versions 5.1.0 and below (and 4.x versions below 4.9.6). The flaw is a code injection weakness that allows unauthenticated attackers to execute arbitrary operating system commands by exploiting missing permission verification on several RocketMQ components, including NameServer, Broker, and Controller. An attacker can abuse the update configuration function or forge RocketMQ protocol content to run commands as the system user running RocketMQ. With a CVSS score of 9.8 and an EPSS score of 94.4% indicating near-certain exploitation, CVE-2023-33246 poses an extreme risk and has been added to CISA's Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | rocketmq | < 4.9.6; >= 5.0.0, < 5.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2023/07/12/1(Mailing List, Third Party Advisory)
- https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp(Mailing List, Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247(Exploit, Third Party Advisory)
- https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT(Exploit)
- https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246(Third Party Advisory, US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CWE-94 describes a weakness where software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code syntax or behavior. In CVE-2023-33246, Apache RocketMQ's configuration update functionality and protocol handling lack proper permission verification, allowing attackers to inject and execute arbitrary system commands through the exposed NameServer, Broker, and Controller components.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2023-33246 has a CVSS v3.1 score of 9.8 (Critical), the highest practical severity rating, reflecting the ease and impact of exploitation. The vulnerability is remotely exploitable over the network without any special conditions, authentication, or user interaction required — making it trivially exploitable by any attacker who can reach the exposed RocketMQ components. Confidentiality (High): attackers can read any data accessible to the RocketMQ system user, including message queues, configuration data, and potentially credentials stored on the server. Integrity (High): arbitrary command execution allows modification of system files, injection of malicious code, and manipulation of message queue data. Availability (High): an attacker can disrupt or destroy the messaging infrastructure, causing widespread service outages. The EPSS score of 94.4% (99.97th percentile) confirms near-certain exploitation activity, and CISA's KEV listing with a September 27, 2023 deadline underscores the critical urgency of remediation.
Exploit Maturity
Public exploit code is available for CVE-2023-33246 from multiple sources, including Packet Storm Security, Vicarius vSociety, and dedicated GitHub repositories such as Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT and jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE. CISA has confirmed active exploitation in the wild by including this vulnerability in its Known Exploited Vulnerabilities catalog. The EPSS score of 94.4% indicates near-certain exploitation activity, consistent with the wide availability of exploit tools and the trivial nature of the attack.
Remediation
- Upgrade Apache RocketMQ immediately to version 5.1.1 or above for RocketMQ 5.x deployments, or version 4.9.6 or above for RocketMQ 4.x deployments, as recommended by Apache and required by CISA's KEV directive.
- Restrict network access to RocketMQ NameServer, Broker, and Controller components by placing them behind a firewall or VPN, ensuring these services are not exposed to the public internet or untrusted networks.
- Implement authentication and access controls on all RocketMQ management interfaces, including the configuration update functionality, to prevent unauthenticated command execution even on internal networks.
- Monitor for indicators of compromise by reviewing RocketMQ server logs for unexpected configuration changes, unusual command execution, or connections from unrecognized IP addresses. Check for signs of post-exploitation activity such as new user accounts, scheduled tasks, or modified binaries.
- Conduct a security review of RocketMQ deployment architecture to ensure that message broker components follow the principle of least privilege, with the RocketMQ process running under a dedicated low-privilege system account rather than root.
Technical Details
CVE-2023-33246 exploits a code injection vulnerability (CWE-94) in Apache RocketMQ's architecture where several critical components — NameServer, Broker, and Controller — are exposed without adequate permission verification. The attack leverages the update configuration function, which accepts externally supplied parameters and executes them in the context of the system user running the RocketMQ process. Alternatively, an attacker can forge RocketMQ protocol messages to achieve the same effect, bypassing any intended access controls. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is a network-accessible, low-complexity attack requiring no privileges or user interaction, making it one of the most exploitable vulnerability profiles possible. The root cause is the absence of authentication and authorization checks on administrative functions that should be restricted to trusted operators, combined with insufficient sanitization of configuration parameters that are passed to system command execution routines.
Frequently Asked Questions
Is CVE-2023-33246 being actively exploited?
Yes, CVE-2023-33246 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 27, 2023. Multiple public exploit tools and proof-of-concept code are freely available, and the EPSS score of 94.4% confirms near-certain exploitation activity. The ransomware association is currently listed as unknown.
What products are affected by CVE-2023-33246?
CVE-2023-33246 affects Apache RocketMQ versions 5.1.0 and below in the 5.x branch, and versions below 4.9.6 in the 4.x branch. The vulnerability impacts the NameServer, Broker, and Controller components when they are accessible on the network without proper permission verification.
How do I fix CVE-2023-33246?
Upgrade Apache RocketMQ to version 5.1.1 or later for 5.x deployments, or version 4.9.6 or later for 4.x deployments. Additionally, ensure that RocketMQ components are not exposed to the internet and implement proper network segmentation and authentication controls on all management interfaces.
How severe is CVE-2023-33246?
CVE-2023-33246 is rated Critical with the maximum practical CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution with no user interaction required, and the EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation. This is among the most severe vulnerability profiles possible.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.