CVE-2023-33246— Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
Quick assessment
Affected
Apache Software Foundation Apache RocketMQ
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache RocketMQ是美国阿帕奇（Apache）基金会的一款轻量级的数据处理平台和消息传递引擎。 Apache RocketMQ 5.1.0及之前版本存在代码注入漏洞，该漏洞源于存在远程命令执行漏洞，攻击者可以利用该漏洞利用更新配置功能以系统用户身份执行命令。
Public Exploits 1
Metasploit · 1
apache_rocketmq_update_config.rb [exploit]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 2 AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-33246
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
Source: CVE Program / CVE List V5
Vulnerability Description
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.
Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache RocketMQ 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache RocketMQ是美国阿帕奇（Apache）基金会的一款轻量级的数据处理平台和消息传递引擎。 Apache RocketMQ 5.1.0及之前版本存在代码注入漏洞，该漏洞源于存在远程命令执行漏洞，攻击者可以利用该漏洞利用更新配置功能以系统用户身份执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache RocketMQ | 0 ~ 5.1.0 | - |
|
II. Public POCs for CVE-2023-33246
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/I5N0rth/CVE-2023-33246 | POC Details |
| 2 | None | https://github.com/yizhimanpadewoniu/CVE-2023-33246-Copy | POC Details |
| 3 | Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit | https://github.com/Le1a/CVE-2023-33246 | POC Details |
| 4 | Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit | https://github.com/SuperZero/CVE-2023-33246 | POC Details |
| 5 | CVE-2023-33246 RocketMQ RCE Detect By Version and Exploit | https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT | POC Details |
| 6 | CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 | https://github.com/CKevens/CVE-2023-33246 | POC Details |
| 7 | RocketMQ RCE (CVE-2023-33246) woodpecker 利用插件 | https://github.com/cr1me0/rocketMq_RCE | POC Details |
| 8 | CVE-2023-33246 | https://github.com/Devil0ll/CVE-2023-33246 | POC Details |
| 9 | CVE-2023-33246 POC | https://github.com/d0rb/CVE-2023-33246 | POC Details |
| 10 | A tool to fetch the RocketMQ broker configuration in order to discover indicators of compromise for CVE-2023-33246 | https://github.com/vulncheck-oss/fetch-broker-conf | POC Details |
| 11 | CVE-2023-33246 - Apache RocketMQ config RCE | https://github.com/0xKayala/CVE-2023-33246 | POC Details |
| 12 | None | https://github.com/MkJos/CVE-2023-33246_RocketMQ_RCE_EXP | POC Details |
| 13 | None | https://github.com/hanch7274/CVE-2023-33246 | POC Details |
| 14 | CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 | https://github.com/3yujw7njai/CVE-2023-33246 | POC Details |
| 15 | None | https://github.com/PavilionQ/CVE-2023-33246-mitigation | POC Details |
| 16 | None | https://github.com/4mazing/CVE-2023-33246-Copy | POC Details |
| 17 | None | https://github.com/Sumitpathania03/Apache-RocketMQ-CVE-2023-33246- | POC Details |
| 18 | CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 | https://github.com/AiK1d/CVE-2023-33246 | POC Details |
| 19 | For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x . | https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-33246.yaml | POC Details |
| 20 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20RocketMQ%20Broker%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2023-33246.md | POC Details |
| 21 | https://github.com/vulhub/vulhub/blob/master/rocketmq/CVE-2023-33246/README.md | POC Details | |
| 22 | None | https://github.com/shoucheng3/apache__rocketmq_CVE-2023-33246_5-1-0 | POC Details |
| 23 | CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 | https://github.com/P4x1s/CVE-2023-33246 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-33246
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2023-33246 (1)
Mailing List Discussions for CVE-2023-33246 (2)
-
https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp vendor-advisory
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-94
-
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Ar -
CVE-2026-100157
WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shor -
CVE-2026-103519
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Ar -
CVE-2026-100152
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcod -
CVE-2026-92536
Paid Membership Plugin, Ecommerce, User Registration Form, L
V. Comments for CVE-2023-33246
No comments yet