CVE-2023-37582
CRITICAL EXPLOITED IN THE WILD NUCLEIApache RocketMQ - Remote Command Execution
Title source: nucleiExploitation Summary
CVE-2023-37582 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 3 public exploits from researchers including Malayke, shoucheng3, laishouchao. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2023-37582, an arbitrary file write vulnerability in Apache RocketMQ's nameserver. It sends a crafted JSON payload to write a file to `/tmp/pwned` via the UPDATE_NAMESRV_CONFIG request.
Description
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Exploits (3)
This PoC exploits CVE-2023-37582, an arbitrary file write vulnerability in Apache RocketMQ's nameserver. It sends a crafted JSON payload to write a file to `/tmp/pwned` via the UPDATE_NAMESRV_CONFIG request.
This repository contains the source code and documentation for Apache RocketMQ, specifically focusing on the ACL (Access Control List) module. It does not include an exploit PoC for CVE-2023-37582 but provides the codebase where the vulnerability may exist.
This PoC is a scanner for CVE-2023-37582, an RCE vulnerability in Apache RocketMQ. It sends a crafted payload to check if the target is vulnerable by matching the version number in the response.
Nuclei Templates (1)
rocketmq port:"9876"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H