Open Nav
Sign Up

Apache RocketMQ Server Vulnerabilities – CVE-2023-33246 and CVE-2023-37582

Critical Vulnerability - Apache RocketMQ Server Vulnerabilities

Bar Refael

January 9, 2024

Security researchers have identified a surge in cyber attacks targeting Apache RocketMQ servers. These attacks exploit critical vulnerabilities, specifically CVE-2023-33246 and CVE-2023-37582, which pose a remote command execution (RCE) risk.

Details of Vulnerabilities

  • CVE-2023-33246 and CVE-2023-37582: Both vulnerabilities are critical in severity and impact multiple components of Apache RocketMQ, including NameServer, Broker, and Controller.
  • Incomplete Patch: Originally, a patch was released by Apache for CVE-2023-33246, but it was insufficient for the NameServer component in RocketMQ, continuing to affect versions 5.1 and older. The issue has evolved and is now also tracked as CVE-2023-37582.
  • Attack Vector: Attackers exploit these vulnerabilities by using the update configuration function on the NameServer when its address is exposed online without proper permission checks. This allows execution of commands as the system users that RocketMQ runs as.

Exploitation in the Wild

  • Increased Scanning Activity: Hundreds of IP addresses have been observed scanning or attempting to exploit vulnerable Apache RocketMQ services.
  • Botnet Exploitation: Since at least August 2023, hackers have been targeting vulnerable systems, with incidents such as the DreamBus botnet leveraging CVE-2023-33246 to deploy XMRig Monero miners on affected servers.
  • CISA Warning: In September 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged federal agencies to patch the flaw, highlighting its active exploitation status.

Recommendations

  • Upgrading Apache RocketMQ: It is advised to upgrade the NameServer to version 5.1.2/4.9.7 or above for RocketMQ 5.x/4.x to mitigate the vulnerabilities.
  • Access Restricting: It is advised to limit all access to RocketMQ servers to authorized users and networks.
  • Monitoring and Vigilance: Organizations should monitor their systems for any signs of these vulnerabilities being exploited and stay vigilant against potential attacks.

Conclusion

The exploitation of Apache RocketMQ servers through these vulnerabilities highlights the need for continuous monitoring and timely patching of critical components in distributed systems. Organizations using Apache RocketMQ should prioritize upgrading their systems and strengthen their security posture to defend against these active threats.

Resources highlights

CVE-2025-55177: WhatsApp Authorization Flaw Exploited in Zero-Click Spyware Chain

WhatsApp has patched CVE-2025-55177, an authorization flaw in its linked-device synchronization feature that was exploited in the wild.  While Meta originally rated it medium severity,…

Read more >

CVE-2025-55177

Docker Issues Patch for Critical Exploit in Docker Desktop: CVE-2025-9074

On August 20, 2025, Docker released an urgent patch for CVE-2025-9074, a critical Server-Side Request Forgery (SSRF) vulnerability (CVSS 9.3) affecting Docker Desktop for Windows…

Read more >

CVE-2025-9074

CVE-2025-48384: Git Submodule Path Flaw Exploited in the Wild

CVE-2025-48384 is a client-side Git vulnerability that lets a malicious repository abuse a mismatch in how Git reads vs. writes configuration values containing a trailing…

Read more >

CVE-2025-48384

CVE-2025-43300: Apple ImageIO Zero-Day Exploited in Targeted Attacks

Apple patched CVE-2025-43300, a zero-day in the ImageIO framework used system-wide to read/write many image formats. Opening or previewing a malicious image can corrupt memory…

Read more >

CVE-2025-43300

CVE-2025-57790: Commvault Path Traversal Vulnerability Leads to RCE

On August 19th, Commvault published advisory CV_2025_08_2 for a newly-discovered path traversal flaw in the Web Server component that allows remote attackers to perform unauthorized…

Read more >

CVE-2025-57790

CVE-2025-20265: Cisco Secure Firewall Management Center (FMC) RADIUS Pre-Auth RCE

A critical (CVSS 10.0)  input-handling flaw in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC), tracked as CVE-2025-20265 allows unauthenticated remote code…

Read more >

CVE-2025-20265
Under Cyber Attack?

Fill out the form and we will contact you immediately.