Loading vulnerability…
CVE-2023-33246 is a remote command execution vulnerability affecting Apache RocketMQ 5.1.0 and earlier, with related affected 4.x releases addressed in later maintenance updates. Under certain deployment conditions, RocketMQ administrative components including NameServer, Broker, and Controller may be reachable from external networks without effective permission verification. An unauthenticated attacker can abuse the update configuration function, or craft RocketMQ protocol content to achieve the same result, to inject configuration values that are later interpreted in a way that results in operating system command execution. In observed exploitation analyses, attackers modified broker configuration fields to trigger shell execution paths and run arbitrary commands as the operating system account used by the RocketMQ service.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository contains a single Metasploit module: 'apache_rocketmq_update_config.rb', which exploits CVE-2023-33246, a remote code execution vulnerability in Apache RocketMQ versions 5.1.0 and below. The exploit targets the RocketMQ Broker component, which, if exposed to the network and lacking proper authentication, allows attackers to inject arbitrary system commands via the update configuration functionality. The module is weaponized, supporting customizable payloads (defaulting to a Meterpreter reverse shell) and is capable of automatically detecting the target version and broker port. The attack is performed over TCP, typically targeting ports 9876 (NameServer) and 10911 (Broker). The exploit is operational on Unix and Linux platforms. The repository is structured as a single Ruby file compatible with the Metasploit framework, and leverages Metasploit's command stager and auxiliary RocketMQ modules for payload delivery and version detection.
This repository is a proof-of-concept exploit for CVE-2023-33246, targeting Apache RocketMQ (version 4.9.1 as per the Maven dependency). The main exploit logic is implemented in 'src/main/java/org/example/Main.java'. The exploit attempts to update the configuration of RocketMQ brokers at three hardcoded IP addresses by injecting a malicious value into the 'rocketmqHome' property. The payload is designed to execute a shell command on the target, which pings a unique domain (chr17sz2vtc0000ymdaggehyuhhyyyyyb.oast.fun) for out-of-band detection of successful command execution. The repository includes standard Java project files and Maven configuration, with the exploit code as the main entry point. No framework is used; this is a standalone Java POC. The attack vector is network-based, requiring access to the RocketMQ broker's management interface.
This repository provides an operational exploit and detection toolkit for CVE-2023-33246, a remote code execution vulnerability in Apache RocketMQ (versions 5.1.0 and below). The main exploit script, 'CVE-2023-33246_RocketMQ_RCE_EXPLOIT.py', crafts and sends a malicious RocketMQ protocol message to a specified broker IP and port (default 10911), injecting arbitrary system commands via the configuration update mechanism. The exploit is executed over a raw TCP connection and can run any command as the RocketMQ service user. The repository also includes 'check.py', a multi-threaded scanner that can check single IPs, files of targets, or CIDR ranges for vulnerable RocketMQ instances, defaulting to port 9876 (nameserver) but configurable. The README provides detailed usage instructions, detection guidance, and mitigation advice. No hardcoded C2 or external endpoints are present in the code, but the exploit is capable of executing arbitrary commands, including those that may reach out to attacker-controlled infrastructure. The repository is structured for both exploitation and detection, with clear separation between the exploit and scanning logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A referenced vulnerability mentioned only as an example of another network out-of-band detection template pattern.
A specific vulnerability identified as CVE-2023-33246 affecting RocketMQ, referenced here in the context of a Linux exploitation simulation dataset.
A remote code execution vulnerability affecting Apache RocketMQ servers that was publicly disclosed in May 2023 and then exploited by threat actors to compromise systems and deploy DreamBus malware.
A remote code execution vulnerability in Apache RocketMQ broker affecting the exposed RocketMQ 4.3.2 instance discussed in the report.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.