Open Nav
Sign Up

Apache RocketMQ Server Vulnerabilities – CVE-2023-33246 and CVE-2023-37582

Critical Vulnerability - Apache RocketMQ Server Vulnerabilities

Bar Refael

January 9, 2024

Security researchers have identified a surge in cyber attacks targeting Apache RocketMQ servers. These attacks exploit critical vulnerabilities, specifically CVE-2023-33246 and CVE-2023-37582, which pose a remote command execution (RCE) risk.

Details of Vulnerabilities

  • CVE-2023-33246 and CVE-2023-37582: Both vulnerabilities are critical in severity and impact multiple components of Apache RocketMQ, including NameServer, Broker, and Controller.
  • Incomplete Patch: Originally, a patch was released by Apache for CVE-2023-33246, but it was insufficient for the NameServer component in RocketMQ, continuing to affect versions 5.1 and older. The issue has evolved and is now also tracked as CVE-2023-37582.
  • Attack Vector: Attackers exploit these vulnerabilities by using the update configuration function on the NameServer when its address is exposed online without proper permission checks. This allows execution of commands as the system users that RocketMQ runs as.

Exploitation in the Wild

  • Increased Scanning Activity: Hundreds of IP addresses have been observed scanning or attempting to exploit vulnerable Apache RocketMQ services.
  • Botnet Exploitation: Since at least August 2023, hackers have been targeting vulnerable systems, with incidents such as the DreamBus botnet leveraging CVE-2023-33246 to deploy XMRig Monero miners on affected servers.
  • CISA Warning: In September 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged federal agencies to patch the flaw, highlighting its active exploitation status.

Recommendations

  • Upgrading Apache RocketMQ: It is advised to upgrade the NameServer to version 5.1.2/4.9.7 or above for RocketMQ 5.x/4.x to mitigate the vulnerabilities.
  • Access Restricting: It is advised to limit all access to RocketMQ servers to authorized users and networks.
  • Monitoring and Vigilance: Organizations should monitor their systems for any signs of these vulnerabilities being exploited and stay vigilant against potential attacks.

Conclusion

The exploitation of Apache RocketMQ servers through these vulnerabilities highlights the need for continuous monitoring and timely patching of critical components in distributed systems. Organizations using Apache RocketMQ should prioritize upgrading their systems and strengthen their security posture to defend against these active threats.

Resources highlights

Cisco IOS and IOS XE SNMP Zero-Day Actively Exploited (CVE-2025-20352)

Cisco disclosed CVE-2025-20352, a stack overflow in the SNMP subsystem of IOS and IOS XE, now confirmed as actively exploited in the wild. Attackers can…

Read more >

CVE-2025-20352

SolarWinds Web Help Desk (WHD) Unauthenticated RCE Patch-Bypass (CVE-2025-26399)

SolarWinds released Web Help Desk 12.8.7 Hotfix 1 to fix CVE-2025-26399, an unauthenticated remote code execution flaw in the AjaxProxy component caused by unsafe deserialization.…

Read more >

CVE-2025-26399

SonicWall Cloud Backup Compromise & Ongoing SSLVPN Exploitation

Threat actors gained access to MySonicWall cloud backup preference files after brute-forcing the vendor’s portal. These files, although encrypted, contain sensitive configuration data such as…

Read more >

sonicwall cloud

Ongoing Supply-Chain Attack Targeting npm Packages (aka “Shai-Hulud”)

Beginning on September 14, 2025, and accelerating over the next two days, attackers launched a large-scale supply-chain attack against the npm ecosystem. The campaign injected…

Read more >

Shai-Hulud

FBI Advisory: UNC6040/UNC6395 Targeting Salesforce Environments

The FBI has issued a FLASH advisory detailing activity from the threat groups UNC6040 and UNC6395, who are actively conducting data theft and extortion campaigns…

Read more >

salesforce fbi advisory

CVE-2024-40766: SonicWall SSL VPN Flaw Actively Exploited by Ransomware Threat Actors

CVE-2024-40766 is a critical improper access control vulnerability in SonicWall SonicOS management access/SSLVPN. Successful exploitation enables unauthorized access and can, in some cases, crash the…

Read more >

CVE-2024-40766
Under Cyber Attack?

Fill out the form and we will contact you immediately.