CVE DatabaseCVE-2023-33246

Updated 2026-06-17한국어 권고문 →

CVE-2023-332469.8/CRITICALCISA KEVCWE-94

Apache RocketMQ Remote Code Execution (RCE) Vulnerability Advisory (CVE-2023-33246)

⚡ Jump to Patch

Affected Vendors

apache

Affected Components

rocketmq

Published Date

2023-05-24

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

96.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Apache RocketMQ versions 5.1.0 and below, and versions 4.9.5 and below

Impact

Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the RocketMQ process, leading to full system compromise

Mitigation

Immediately upgrade to RocketMQ version 5.1.1 or above (for 5.x) or 4.9.6 or above (for 4.x)

Affected Products & Version Scope

Apache RocketMQ versions 5.1.0 and below (5.x branch), Apache RocketMQ versions 4.9.5 and below (4.x branch)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official security patches by upgrading to RocketMQ 5.1.1+ or 4.9.6+. Below is an example of upgrading a Docker-based RocketMQ deployment.

bash

# 1. Stop and remove vulnerable containers
docker stop rocketmq-broker rocketmq-namesrv
docker rm rocketmq-broker rocketmq-namesrv

# 2. Pull the patched image (e.g., version 5.1.1)
docker pull apache/rocketmq:5.1.1

# 3. Restart the services using the secure image version
docker run -d -p 9876:9876 --name rocketmq-namesrv apache/rocketmq:5.1.1 sh mqnamesrv

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to RocketMQ ports (9876, 10909, 10911, 10912) using firewall rules to ensure only trusted internal IPs can communicate with the cluster.

bash

# Block public access to RocketMQ ports and allow only a trusted administration IP
iptables -A INPUT -p tcp -s 203.0.113.50 --dport 9876 -j ACCEPT
iptables -A INPUT -p tcp -s 203.0.113.50 --dport 10911 -j ACCEPT
iptables -A INPUT -p tcp --dport 9876 -j DROP
iptables -A INPUT -p tcp --dport 10911 -j DROP

3. Log Audit & IoC Verification Commands

Inspect RocketMQ broker logs for unauthorized configuration updates or suspicious command execution patterns.

bash

# Search for configuration update events and potential shell execution indicators in the logs
grep -i 'updateBrokerConfig' /home/rocketmq/logs/rocketmqlogs/broker.log
grep -i -E '(sh|bash|curl|wget|python)' /home/rocketmq/logs/rocketmqlogs/broker.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Datadog Cloud & Kubernetes Security

Due to active exploitation in the wild, immediately restrict network exposure of RocketMQ ports and upgrade to patched versions (5.1.1 / 4.9.6 or higher).

Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet

Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.

Real-Time Production Container CVE Mapping

Start 14-Day Free Cloud Security Trial

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-33246) is a critical Remote Code Execution (RCE) flaw affecting Apache RocketMQ's NameServer, Broker, and Controller components. The root cause lies in the lack of proper permission verification on these components when they are exposed to the external network. Attackers can exploit this by leveraging the 'update configuration' function or forging RocketMQ protocol packets to execute arbitrary commands.

2. Exploitation Mechanics & Attack Scenario

An attacker scans for publicly accessible RocketMQ ports (such as NameServer on 9876 or Broker on 10911). By crafting and sending malicious payloads conforming to the RocketMQ protocol, the attacker triggers the configuration update function. Because the application fails to validate the input parameters, the injected commands are executed by the host operating system under the context of the user running the RocketMQ service.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat as it is actively exploited in the wild. Successful exploitation allows attackers to compromise sensitive message queues, exfiltrate proprietary business data, establish persistence, and pivot laterally within the internal network to deploy ransomware or cryptominers.

Official Vendor Advisories & References

NVD Original English Description

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html

Source: security@apache.org · Exploit, Third Party Advisory, VDB Entry

http://www.openwall.com/lists/oss-security/2023/07/12/1

Source: security@apache.org · Mailing List, Third Party Advisory

https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp

Source: security@apache.org · Mailing List, Vendor Advisory

http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

http://www.openwall.com/lists/oss-security/2023/07/12/1

Source: af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Third Party Advisory

https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp

Source: af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2023-33246)

FAQ

Q1. How critical is CVE-2023-33246 and is it actively exploited in the wild?

CVE-2023-33246 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 96.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-33246?

Primary impacted vendors include apache across rocketmq. Scope summary: Apache RocketMQ versions 5.1.0 and below (5.x branch), Apache RocketMQ versions 4.9.5 and below (4.x branch)

Q3. What temporary mitigations or workarounds exist for CVE-2023-33246 before patching?

[Mitigation] Immediately upgrade to RocketMQ version 5.1.1 or above (for 5.x) or 4.9.6 or above (for 4.x) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION