Patchfirst
Patchfirst
CVE-2023-37582 Public exploit Critical · 9.8 EPSS 90.4%

Apache RocketMQ: Possible remote code execution when using the update configuration function

Apache Software Foundation · Apache RocketMQ

Official description · CVE.org

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.

Breakdown
68.7 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 14 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+2 days
  3. First seen exploitedVulnCheck KEV evidence+14 mo

See the family tree

A fix was bypassed or incomplete once over 7 weeks. The latest fix listed for rocketmq-namesrv is 5.1.2.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-33246RocketMQ Command Execution24 May 2023KEV
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textThe RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
    • Fixed one release later4.9.6 → 4.9.7 (org.apache.rocketmq:rocketmq-namesrv)
    • Fixed one release later5.1.1 → 5.1.2 (org.apache.rocketmq:rocketmq-namesrv)
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    This CVECVE-2023-37582RocketMQ: Possible remote code execution when using the update…12 Jul 2023

Fixes in rocketmq-namesrvMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.1.1CVE-2023-3324624 May 2023KEV
  2. 5.1.2CVE-2023-3758212 Jul 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.rocketmq:rocketmq-namesrv.

Mavenorg.apache.rocketmq:rocketmq-namesrvGHSA-gpq8-963w-8qc9

Upgrade to 5.1.2 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-33246).

Set the version to 5.1.2 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-37582.

Affected versions, by release line

If you runUpgrade to
5.0.0 up to 5.1.25.1.2
All versions before 4.9.74.9.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 6 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

vendor-advisory 1

lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc

Other 1

openwall.com/lists/oss-security/2023/07/12/1
↑ ↓ chooseEnter openEsc close