CVE-2023-33246

이 저장소에는 README가 없습니다...

Apache-RocketMQ-CVE-2023-33246-

CVE-2023-33246: Apache RocketMQ 원격 코드 실행 개요 Apache RocketMQ는 가장 인기 있고 널리 사용되는 분산 메시징 및 스트리밍 플랫폼 중 하나입니다. 최근 Apache RocketMQ 버전 5.1.0 이하에서 명령 실행 취약점이 보고되었습니다. 원격의 인증되지 않은 사용자는 업데이트 구성 기능을 이용하여 RocketMQ 사용자 프로세스와 동일한 액세스 수준으로 명령을 실행할 수 있습니다. 주요 구성 요소 네임서버Nameserver: 1. RocketMQ의 네임서버는 전체 메시징 인프라에 대...

CVE-2023-33246-mitigation

CVE-2023-33246-mitigation このプロジェクトは、Apache RocketMQ の脆弱性である CVE-2023-33246 を緩和するための Maven ベースのデモンストレーションです。 プロジェクト構成 org/example/Main.java：メインプログラムファイル。 org/apache/rocketmq/common/BrokerConfig.java：公式 RocketMQ 4.9.5 ソースコードの修正版。 主な機能 1. 攻撃テスト ：Main.java の updateConfig メソッドは攻撃テスト用に使用されます。 2. 検証の強化...

CVE-2023-33246

CVE-2023-33246 CVE-2023-33246：Apache RocketMQ 원격 명령 실행 취약점 탐지 도구 도구 기능 간단 사용 실행 ./apacherocketmqcve202333246scannerlinuxamd64 scan 출력에 취약점 존재 여부: 예 또는 VulnFound: true 이면 취약점이 존재함을 의미합니다. Version 또는 버전 번호 필드는 도구가 탐지한 자산의 버전입니다. 탐지 데이터를 json 파일로 출력 실행 apacherocketmqcve202333246scannerlinuxamd64 sca...

CVE-2023-33246

CVE-2023-33246 Apache RocketMQ 원격 코드 실행 취약점CVE-2023-33246 Exploit 사용 방법: java -jar CVE-2023-33246.jar -ip "127.0.0.1:10911" -cmd "open -a Calculator" 이 도구의 특징 하트비트 메커니즘으로 인해 30초마다 취약점이 트리거되므로, 도구가 35초 지연되어 명령이 실행되도록 보장한 후 설정 파일을 복원합니다. 따라서 이 도구를 사용하여 취약점을 이용할 때 환경에 영향을 미치지 않습니다! 단, 도구가 자연스럽게 종료될...

CVE-2023-33246-Copy

1. 참고 학습 CVE-2023-33246 https://github.com/I5N0rth/CVE-2023-33246 2. 로컬 환경 구축 2.1 이미지 다운로드 docker pull apache/rocketmq:4.9.1 docker pull apacherocketmq/rocketmq-console:2.0.0 2.2 broker, namesrv, console 시작 namesrv 시작 docker run -dit -p 9876:9876 -p 10909:10909 --name mqsrv -e...

fetch-broker-conf

Fetch Broker Configuration Fetch Broker Configuration는 rocketmqHome 변수에서 침해 지표를 찾기 위해 RocketMQ 브로커 구성을 다운로드하려고 시도합니다. 이 변수는 다양한 공격자가 CVE-2023-33246을 통해 코드를 실행하는 데 사용합니다. 자세한 내용은 VulnCheck 블로그를 참조하세요. 컴파일 makefile을 사용하여 Docker 컨테이너를 빌드할 수 있습니다: make docker 또는 Go 빌드 환경이 준비되어 있다면 make를 사용하면 됩니다:...

apache__rocketmq_CVE-2023-33246_5-1-0

Apache RocketMQ !Build Statusmaven-build-imagemaven-build-url !CodeCovcodecov-imagecodecov-url !Maven Centralmaven-central-imagemaven-central-url !Releaserelease-imagerelease-url !Licenselicense-imagelicense-url !Average Time to Resolve An...

VulnCheck KEV: CVE-2023-37582

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

Muhstik botnet exploits a critical Apache RocketMQ flaw CVE-2023-33246 for remote code execution, targeting Linux servers and IoT devices for DDoS attacks and cryptocurrency mining. Infection involves executing a shell script from a remote IP, downloading the Muhstik malware binary "pty3", and...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ Remote...

Attacks, Vulnerabilities and Actors 4 September to 10 September 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of ten executed attacks, one instance of adversary activity, and six vulnerabilities...

CISA Adds One Known Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-33246 Apache RocketMQ Command Execution Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant...

Arbitrary Code Injection

org.apache.rocketmq, rocketmq-namesrv is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library allows updating the config path at runtime, allowing an attacker to inject and execute malicious code through the update configuration function by forging the RocketMQ...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-37582EXPLOIT Apache RocketMQ Arbitrary File Write Vu...

Design/Logic Flaw

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Apache RocketMQ 5.1.0 Arbitrary Code Injection Exploit

RocketMQ versions 5.1.0 and below are vulnerable to arbitrary code injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that...

Metasploit Weekly Wrap-Up

Apache RocketMQ We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246. In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246 Apache RocketMQ remote code execution vulnera...

CVE-2023-33246

creationtimestamp| type| source ---|---|--- 2023-05-30 15:17:54+00:00| published-proof-of-concept| https://t.me/dilagrafie/3071 2023-05-30 15:54:33+00:00| published-proof-of-concept| https://t.me/proxybar/1551 2023-06-01 02:21:39+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4466...