GHSA-Q9W2-H4CW-8GHP Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

CVE-2024-23321

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

CVE-2024-23321 Apache RocketMQ: Unauthorized Exposure of Sensitive Data

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

CVE-2024-23321 Apache RocketMQ: Unauthorized Exposure of Sensitive Data

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

CVE-2024-23321

CVE-2024-23321 affects RocketMQ 5.2.0 and earlier, where under certain conditions an attacker with regular user privileges (or IP whitelist-listed) can disclose administrator credentials via specific interfaces, gaining full control if they can access the broker IP address list. The risk arises d...

Muhstik Botnet Exploits Apache RocketMQ Flaw in Latest Operations

...

Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

Muhstik botnet exploits a critical Apache RocketMQ flaw CVE-2023-33246 for remote code execution, targeting Linux servers and IoT devices for DDoS attacks and cryptocurrency mining. Infection involves executing a shell script from a remote IP, downloading the Muhstik malware binary "pty3", and...

Security Bulletin: IBM Instana Observability is affected by Vulnerabilities in Apache RocketMQ

Summary Vulnerabilities in Apache RocketMQ were remediated in IBM Observability with Instana build 255. Vulnerability Details CVEID:CVE-2023-33246 DESCRIPTION: Apache RocketMQ could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw when using the update...

Apache RocketMQ 4.2.0 < 4.6.1 Directory Traversal (CVE-2023-37582)

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like ../../../../topic2020 is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal...

Apache RocketMQ < 4.9.7 / 5.x < 5.1.2 RCE (CVE-2023-37582)

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 4.9.6 / 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246...

Apache RocketMQ Detection

Binary data apacherocketmqdetect.nbin...

DreamBus Botnet Exploiting A Critical Vulnerability in Apache RocketMQ

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical vulnerability CVE-2023-33246 in Apache RocketMQ servers enables remote code execution, leading to a surge in attacks, including the deployment of the DreamBus malware. Timely system...

Apache RocketMQ Command Execution Vulnerability

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running...

Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New Exploits

Recently disclosed security flaws impacting Juniper firewalls, Openfire, and Apache RocketMQ servers have come under active exploitation in the wild, according to multiple reports. The Shadowserver Foundation said that it's "seeing exploitation attempts from multiple IPs for Juniper J-Web...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-37582EXPLOIT Apache RocketMQ Arbitrary File Write Vu...

Apache RocketMQ Code Injection Vulnerability

Apache RocketMQ is the United States Apache Apache Foundation of a lightweight data processing platform and messaging engine. Apache RocketMQ suffers from a code injection vulnerability that originates from an extranet leak of the NameServer address and lack of privilege authentication, which can...

CVE-2023-37582 Apache RocketMQ: Possible remote code execution when using the update configuration function

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Apache RocketMQ 5.1.0 Arbitrary Code Injection Exploit

RocketMQ versions 5.1.0 and below are vulnerable to arbitrary code injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that...

Metasploit Weekly Wrap-Up

Apache RocketMQ We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246. In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without...