CVE-2023-33246
Published: September 6, 2023
Official Description
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
CISA KEV Advisory
Apache RocketMQ Command Execution Vulnerability
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, lack permission verification when exposed to the extranet. This allows an attacker to execute commands as the system user running RocketMQ or achieve similar effects by forging protocol content. This is a HIGH severity vulnerability with a high EPSS score of 0.94388, indicating a high likelihood of exploitation. CISA has confirmed its exploitation in the KEV catalog.
This vulnerability is actively being exploited in the wild. It can be exploited remotely due to the lack of permission verification on extranet-exposed components.
Apache RocketMQ users should ensure that NameServer, Broker, and Controller components are not exposed to the extranet without proper authentication and authorization. Apply available security patches and implement robust access controls.
Technical Analysis
CVE-2023-33246 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2023-33246 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2023-33246 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1