{"id":"CVE-2023-37582","published":"2023-07-12T09:26:18Z","modified":"2025-04-23T16:20:32Z","title":"Apache RocketMQ: Possible remote code execution when using the update configuration function","vendor":"Apache Software Foundation","product":"Apache RocketMQ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache RocketMQ","versions":[">= 5.0.0, <= 5.1.1","<= 4.9.6"]}],"description":{"text":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. \n\nWhen NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. \n\nIt is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.90427,"percentile":0.99799,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-09-18","exploitedFirstSeen":"2024-09-18","ransomware":false,"evidence":[{"url":"https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF","date":"2024-09-18"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"Update 10: Cybercriminals Leverage 66 Vulnerabilities to Target Global Systems","url":"https://otx.alienvault.com/pulse/68651d685fb2301208e89b10","created":"2025-07-02"},{"name":"NCSC Advisory - 18th Sept 2024 - PRC Botnet","url":"https://otx.alienvault.com/pulse/678638141cbf938dbca1090d","created":"2025-01-14"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd56c6fd3f2632e1b4411","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd54761ae1299ecfe27aa","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/66fd391fe0318d98f8af0eb4","created":"2024-10-02"},{"name":"CSA-PRC-LINKED-ACTORS-BOTNET","url":"https://otx.alienvault.com/pulse/66ebe08841abbc50444fbcae","created":"2024-09-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/12/1","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":["<4.9.7",">=5.0.0, <5.1.2"],"patched":["4.9.7","5.1.2"],"from":["GHSA-gpq8-963w-8qc9"],"provenance":"source"}],"advisories":[{"id":"GHSA-gpq8-963w-8qc9","url":"https://github.com/advisories/GHSA-gpq8-963w-8qc9","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":["<4.9.7"],"patched":["4.9.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-gpq8-963w-8qc9","url":"https://github.com/advisories/GHSA-gpq8-963w-8qc9","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":[">=5.0.0, <5.1.2"],"patched":["5.1.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2067","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2067","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2023-07-14","earliestUrl":"https://github.com/Malayke/CVE-2023-37582_EXPLOIT","repos":[{"name":"Malayke/CVE-2023-37582_EXPLOIT","url":"https://github.com/Malayke/CVE-2023-37582_EXPLOIT","stars":47,"created":"2023-07-14"},{"name":"laishouchao/Apache-RocketMQ-RCE-CVE-2023-37582-poc","url":"https://github.com/laishouchao/Apache-RocketMQ-RCE-CVE-2023-37582-poc","stars":1,"created":"2025-05-12"}]},"nuclei":[{"id":"CVE-2023-37582","name":"Apache RocketMQ - Remote Command Execution","severity":"critical","path":"network/cves/2023/CVE-2023-37582.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-37582.yaml"}],"first":{"date":"2023-07-14","source":"PoC-in-GitHub","url":"https://github.com/Malayke/CVE-2023-37582_EXPLOIT"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-37582","provenance":"source"},{"date":"2023-07-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Malayke/CVE-2023-37582_EXPLOIT","provenance":"source"},{"date":"2024-09-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 771 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-rocketmq-cve-2023-33246","parents":[{"from":"CVE-2023-33246","to":"CVE-2023-37582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.","from":"CVE.org","in":"CVE-2023-37582"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.rocketmq:rocketmq-namesrv","fromFixed":"4.9.6","toFixed":"4.9.7","daysApart":49},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.rocketmq:rocketmq-namesrv","fromFixed":"5.1.1","toFixed":"5.1.2","daysApart":49},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-33246","published":"2023-05-24","fixed":"5.1.1","kev":true},{"cve":"CVE-2023-37582","published":"2023-07-12","fixed":"5.1.2","kev":false}],"package":"Maven:org.apache.rocketmq:rocketmq-namesrv"}}