Apache-RocketMQ-CVE-2023-33246-

CVE-2023-33246: Apache RocketMQ 원격 코드 실행 개요 Apache RocketMQ는 가장 인기 있고 널리 사용되는 분산 메시징 및 스트리밍 플랫폼 중 하나입니다. 최근 Apache RocketMQ 버전 5.1.0 이하에서 명령 실행 취약점이 보고되었습니다. 원격의 인증되지 않은 사용자는 업데이트 구성 기능을 이용하여 RocketMQ 사용자 프로세스와 동일한 액세스 수준으로 명령을 실행할 수 있습니다. 주요 구성 요소 네임서버Nameserver: 1. RocketMQ의 네임서버는 전체 메시징 인프라에 대...

CVE-2023-33246-mitigation

CVE-2023-33246-mitigation このプロジェクトは、Apache RocketMQ の脆弱性である CVE-2023-33246 を緩和するための Maven ベースのデモンストレーションです。 プロジェクト構成 org/example/Main.java：メインプログラムファイル。 org/apache/rocketmq/common/BrokerConfig.java：公式 RocketMQ 4.9.5 ソースコードの修正版。 主な機能 1. 攻撃テスト ：Main.java の updateConfig メソッドは攻撃テスト用に使用されます。 2. 検証の強化...

CVE-2023-33246

CVE-2023-33246 CVE-2023-33246：Apache RocketMQ リモートコマンド実行脆弱性検出ツール ツール機能 簡単な使い方 ./apacherocketmqcve202333246scannerlinuxamd64 scan を実行します 出力で脆弱性の有無が「是」または VulnFound: true と表示された場合は、脆弱性が存在することを意味します。Version または「版本号」フィールドは、ツールが検出したアセットのバージョンです。 検出データを json ファイルに出力します...

CVE-2023-33246

CVE-2023-33246 Apache RocketMQ リモートコード実行脆弱性CVE-2023-33246 Exploit 使用方法: root@kitploit: java -jar CVE-2023-33246.jar -ip "127.0.0.1:10911" -cmd "open -a Calculator" 本ツールの特徴...

CVE-2023-33246

このリポジトリには README がありません。...

CVE-2023-33246-Copy

1. 参考学習 CVE-2023-33246 https://github.com/I5N0rth/CVE-2023-33246 2. ローカル環境の構築 2.1 イメージのダウンロード root@kitploit: docker pull apache/rocketmq:4.9.1 docker pull apacherocketmq/rocketmq-console:2.0.0 2.2 broker、namesrv、console の起動 namesrv の起動 root@kitploit: docker run -dit -p 9876:9876 -p 10909:10909...

fetch-broker-conf

Fetch Broker Configuration Fetch Broker Configuration は、侵害の指標を rocketmqHome 変数内で探すために、RocketMQ ブローカー設定のダウンロードを試みます。この変数は、CVE-2023-33246 を介してコードを実行するために様々な攻撃者によって利用されます。詳細については、VulnCheck ブログ を参照してください。 コンパイル Docker コンテナをビルドするには makefile を使用できます: root@kitploit: make docker または、Go ビルド環境が整っている場合は、単に...

apache__rocketmq_CVE-2023-33246_5-1-0

Apache RocketMQ...

VulnCheck KEV: CVE-2023-37582

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

Muhstik botnet exploits a critical Apache RocketMQ flaw CVE-2023-33246 for remote code execution, targeting Linux servers and IoT devices for DDoS attacks and cryptocurrency mining. Infection involves executing a shell script from a remote IP, downloading the Muhstik malware binary "pty3", and...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ Remote...

Attacks, Vulnerabilities and Actors 4 September to 10 September 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of ten executed attacks, one instance of adversary activity, and six vulnerabilities...

CISA Adds One Known Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-33246 Apache RocketMQ Command Execution Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant...

Arbitrary Code Injection

org.apache.rocketmq, rocketmq-namesrv is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library allows updating the config path at runtime, allowing an attacker to inject and execute malicious code through the update configuration function by forging the RocketMQ...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-37582EXPLOIT Apache RocketMQ Arbitrary File Write Vu...

Design/Logic Flaw

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Apache RocketMQ 5.1.0 Arbitrary Code Injection Exploit

RocketMQ versions 5.1.0 and below are vulnerable to arbitrary code injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that...

Metasploit Weekly Wrap-Up

Apache RocketMQ We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246. In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246 Apache RocketMQ remote code execution vulnera...

CVE-2023-33246

creationtimestamp| type| source ---|---|--- 2023-05-30 15:17:54+00:00| published-proof-of-concept| https://t.me/dilagrafie/3071 2023-05-30 15:54:33+00:00| published-proof-of-concept| https://t.me/proxybar/1551 2023-06-01 02:21:39+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4466...