CVE-2023-33246 PoC — Apache RocketMQ 代码注入漏洞

介绍

# CVE-2023-33246-mitigation

This project is a Maven-based demonstration of mitigating CVE-2023-33246, a vulnerability in Apache RocketMQ.

## Project Structure

- `org/example/Main.java`: The main program file.
- `org/apache/rocketmq/common/BrokerConfig.java`: Modified version of the official RocketMQ 4.9.5 source code.

## Main Features

1. **Attack Testing**: The `updateConfig` method in `Main.java` is used for attack testing purposes.

2. **Enhanced Validation**: The `BrokerConfig.java` file includes a new method `getValidatedRocketmqHome()`. This method strengthens the validation of the `RocketmqHome` parameter to prevent potential attacks.

## Base Source Code

This project is based on Apache RocketMQ 4.9.5. The complete official source code can be downloaded from:

[RocketMQ 4.9.5 Source Release](https://dist.apache.org/repos/dist/release/rocketmq/4.9.5/rocketmq-all-4.9.5-source-release.zip)

文件快照

备注