Product Introduction#
Apache RocketMQ is a lightweight data processing platform and message delivery engine from the Apache Foundation.
Vulnerability Overview#
Apache RocketMQ versions 5.1.0 and earlier have a code injection vulnerability. This vulnerability is due to a remote command execution vulnerability, which allows attackers to execute commands as system users by exploiting the update configuration function.
Impact Scope#
<5.1.0
Vulnerability Reproduction#
Environment setup:
docker pull apache/rocketmq:4.9.4
# Start nameserver
docker run -d --name rmqnamesrv -p 9876:9876 apache/rocketmq:4.9.4 sh mqnamesrv
# Start Broker
docker run -d --name rmqbroker --link rmqnamesrv:namesrv -e "NAMESRV_ADDR=namesrv:9876" -p 10909:10909 -p 10911:10911 -p 10912:10912 apache/rocketmq:4.9.4 sh mqbroker -c /home/rocketmq/rocketmq-4.9.4/conf/broker.conf
Check for vulnerability using the script
Reverse shell
nc listens on 1234
Recommended Fixes#
Official patches have been released. Official patch download link: https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp