CVE-2023-33246

What is Apache RocketMQ?

Apache RocketMQ is a distributed message queue and streaming data platform originally developed by Alibaba and donated to the Apache Software Foundation. It is widely used in large-scale Java and cloud-native applications across Asia and globally for asynchronous messaging, event streaming, and decoupling of microservices. RocketMQ components — NameServer (service discovery), Broker (message storage and routing), and Controller — expose management APIs on the network for configuration and administration. When these management interfaces are internet-accessible without authentication controls, they represent a critical attack surface.

Overview

CVE-2023-33246 is a critical unauthenticated remote code execution vulnerability in Apache RocketMQ affecting versions 5.1.0 and below and 4.x before 4.9.6. Multiple RocketMQ components (NameServer, Broker, Controller) expose management APIs without sufficient authentication, allowing an unauthenticated attacker to either invoke the updateConfig function to write attacker-controlled configuration (enabling arbitrary command execution) or forge RocketMQ protocol messages to achieve the same effect. Apache patched it in versions 5.1.1 and 4.9.6. Following public PoC publication in June 2023, mass exploitation by cryptominers and threat actors began rapidly. CISA added it to KEV in September 2023.

Affected Versions

Technical Details

CWE-94 (Improper Control of Generation of Code). Apache RocketMQ's management plane exposes an updateConfig API endpoint on the NameServer and Broker components. This function is intended for administrative use but lacks proper authentication — any network-reachable client can invoke it. The updateConfig function allows overwriting configuration file entries for the RocketMQ broker, including configuration keys that control command execution at broker startup or operation.

An attacker exploiting CVE-2023-33246 can:

1. Invoke updateConfig to set a malicious configuration value (e.g., rocketmqHome or filter server configuration) that causes the broker to execute an OS command upon next operation.
2. Alternatively, forge RocketMQ wire protocol messages to reach privileged broker operations without authentication.

The result is OS command execution under the user account running RocketMQ — which in many deployments runs as a service account with broad system access. Combined with the widespread deployment of RocketMQ in cloud-native environments, a compromised broker can pivot to cloud metadata services, container orchestration APIs, and adjacent services.

Discovery

The vulnerability was identified by security researchers analyzing the authentication handling in RocketMQ's management interfaces. The Apache RocketMQ project released patches (versions 5.1.1 and 4.9.6) before the CVE was formally published, but the publication and subsequent PoC release triggered active exploitation.

Exploitation Context

Following public PoC availability in early June 2023, threat actors rapidly weaponized CVE-2023-33246. Security researchers documented multiple exploitation campaigns:

• Cryptominers: The primary initial exploiters, using RCE to deploy XMRig or similar cryptocurrency mining malware on compromised RocketMQ servers. The DreamBus botnet was documented exploiting CVE-2023-33246.
• Ransomware precursors: Post-compromise reconnaissance tools were observed being deployed on compromised instances, suggesting use as an initial access vector for broader network intrusion.

The CISA KEV addition in September 2023 — three months after the CVE — reflects sustained exploitation of unpatched internet-exposed RocketMQ deployments. The vulnerability particularly affects RocketMQ deployments that were configured with management ports open to the internet without firewall restrictions.

Remediation

1. Upgrade Apache RocketMQ to version 5.1.1 (for 5.x) or 4.9.6 (for 4.x) immediately.
2. Restrict RocketMQ's NameServer and Broker ports (default: 9876 for NameServer, 10909/10911 for Broker) to trusted internal networks only — these should never be internet-accessible.
3. Use RocketMQ's ACL (Access Control List) functionality to require authentication for all management operations.
4. Audit RocketMQ configuration files for unauthorized modifications — check broker.conf and namesrv.conf for unexpected entries that could indicate exploitation.
5. Review broker logs for unexpected updateConfig calls or connections from external IP addresses.
6. Inspect the RocketMQ host for unauthorized processes (cryptominers, backdoors) and check for new cron jobs or scheduled tasks.