来源

关联漏洞

介绍

# CVE-2023-33246-mitigation

This project is a Maven-based demonstration of mitigating CVE-2023-33246, a vulnerability in Apache RocketMQ.

## Project Structure

- `org/example/Main.java`: The main program file.
- `org/apache/rocketmq/common/BrokerConfig.java`: Modified version of the official RocketMQ 4.9.5 source code.

## Main Features

1. **Attack Testing**: The `updateConfig` method in `Main.java` is used for attack testing purposes.

2. **Enhanced Validation**: The `BrokerConfig.java` file includes a new method `getValidatedRocketmqHome()`. This method strengthens the validation of the `RocketmqHome` parameter to prevent potential attacks.

## Base Source Code

This project is based on Apache RocketMQ 4.9.5. The complete official source code can be downloaded from:

[RocketMQ 4.9.5 Source Release](https://dist.apache.org/repos/dist/release/rocketmq/4.9.5/rocketmq-all-4.9.5-source-release.zip)

文件快照

 [4.0K]  /data/pocs/b0bf4bc1dc26d4ea5f434d65b822528b5e7caea4
├── [1.0K]  pom.xml
├── [ 912]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [4.0K]  org
                ├── [4.0K]  apache
                │   └── [4.0K]  rocketmq
                │       └── [4.0K]  common
                │           └── [ 27K]  BrokerConfig.java
                └── [4.0K]  example
                    └── [2.5K]  Main.java

8 directories, 4 files

备注