CVE-2023-33246 RocketMQ
| Affected software | RocketMQ |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 5.1.1 |
| Weakness | Code injection (CWE-94) |
| Published | 24 May 2023 |
| Updated | 29 Sep 2026 |
Description
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2023-09-06 · remediation due 2023-09-27 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 11 citations · honeypot sightings · 8 exploits · earliest 2023-08-28.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 13 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2023-05-30.
- EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-33246 in VulnCheck (free account), which lists 6 more citations and 3 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 592 days | 2024-01-01 to 2026-11-10 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 9 days | 2026-06-07 to 2026-10-08 |
| Reported exploitation | blogs.juniper.net | /en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability | 2023-08-28 |
| Reported exploitation | vulncheck.com | /blog/rocketmq-exploit-payloads | 2023-09-05 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2023-09-06 |
| Reported exploitation | zscaler.com | /blogs/security-research/dreambus-unleashes-metabase-mayhem-new-exploit-module | 2024-01-11 |
| Reported exploitation | horizon3.ai | /analysis-of-2023s-known-exploited-vulnerabilities | 2024-02-06 |
| Exploit reference | VulnCheck XDB cf4f1e593dfc | Exploit type: initial-access | 2023-05-30 |
| Exploit reference | VulnCheck XDB b486dcf3f31d | Exploit type: initial-access | 2023-06-01 |
| Exploit reference | VulnCheck XDB 3068e2f9ef10 | Exploit type: initial-access | 2023-08-11 |
| Exploit reference | VulnCheck XDB 6a010bfe0097 | Exploit type: initial-access | 2023-09-04 |
| Exploit reference | VulnCheck XDB 893a13b107de | Exploit type: initial-access | 2023-12-20 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit | 113 | 2023-06-01 |
| Nuclei | RocketMQ <= 5.1.0 - Remote Code Execution | ||
| Metasploit | Apache RocketMQ update config RCE (excellent rank) | ||
| GitHub PoC | CVE-2023-33246 RocketMQ RCE Detect By Version and Exploit | 106 | 2023-06-01 |
| GitHub PoC | Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit | 81 | 2023-06-01 |
| GitHub PoC | I5N0rth/CVE-2023-33246 | 62 | 2023-05-30 |
| GitHub PoC | A go-exploit for fetching the RocketMQ broker configuration in order to discover indicators of compromise for CVE-2023-33246 | 5 | 2023-09-04 |
| GitHub PoC | CVE-2023-33246 - Apache RocketMQ config RCE | 2 | 2023-10-28 |
| GitHub PoC | CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 | 2 | 2023-06-02 |
| GitHub PoC | PavilionQ/CVE-2023-33246-mitigation | 1 | 2024-06-29 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Unauthenticated UPDATE_BROKER_CONFIG sets rocketmqHome, which FilterServerUtil.callShell passes to Runtime.exec("sh -c ..."); the Process rule blocks the fork when its execute list matches bare sh as well as /bin/* and /usr/bin/*. The attacker changing the broker's settings is not stopped.
How to mitigate CVE-2023-33246
Upgrade RocketMQ to 5.1.1 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.rocketmq:rocketmq-broker |
5.0.0 | 5.1.1 |
unbounded |
org.apache.rocketmq:rocketmq-namesrv |
4.0.0 | 4.9.6 |
unbounded |
org.apache.rocketmq:rocketmq-controller |
5.0.0 | 5.1.1 |
unbounded |
org.apache.rocketmq:rocketmq-namesrv |
5.0.0 | 5.1.1 |
unbounded |
Products and versions
4 products, 6 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | rocketmq | generic | ＜ 4.9.6 · ≥ 5.0.0 and ＜ 5.1.1 |
| osv | org.apache.rocketmq | rocketmq-broker | generic | ≥ 5.0.0 and ＜ 5.1.1 |
| osv | org.apache.rocketmq | rocketmq-controller | generic | ≥ 5.0.0 and ＜ 5.1.1 |
| osv | org.apache.rocketmq | rocketmq-namesrv | generic | ≥ 4.0.0 and ＜ 4.9.6 · ≥ 5.0.0 and ＜ 5.1.1 |
References
Timeline
Timeline
| Published | 2023-05-24 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2023-08-28 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2023-09-06 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-10 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |