{"id":"CVE-2023-33246","published":"2023-05-24T15:15:09Z","modified":"2026-06-17T06:01:24Z","title":"Apache RocketMQ Command Execution Vulnerability","vendor":"Apache","product":"RocketMQ","tier":"core","eol":null,"description":{"text":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. \n\nSeveral components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. \n\nTo prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .","provenance":"source","from":"NVD"},"summary":{"text":"Apache RocketMQ 5.1.0 and below has a flaw in its NameServer, Broker, and Controller components that allows remote command execution. An attacker who can reach these components over the network, which are exposed on the extranet and lack permission verification, can use the update configuration function or forge RocketMQ protocol content to run commands as the system user RocketMQ runs under, with no authentication required and only under the conditions that make these components reachable.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:51Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96568,"percentile":0.99882,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-09-06","dueDate":"2023-09-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp;  https://nvd.nist.gov/vuln/detail/CVE-2023-33246","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-08-28","exploitedFirstSeen":"2023-08-28","ransomware":false,"evidence":[{"url":"https://blogs.juniper.net/en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability","date":"2023-08-28"},{"url":"https://vulncheck.com/blog/rocketmq-exploit-payloads","date":"2023-09-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-09-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-01"},{"url":"https://www.zscaler.com/blogs/security-research/dreambus-unleashes-metabase-mayhem-new-exploit-module","date":"2024-01-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2023-33246","date":"2024-01-26"}],"evidenceTotal":600,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/12/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp","tags":["Mailing List","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/12/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp","tags":["Mailing List","Vendor Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT","tags":["Exploit"]},{"url":"https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.","confidence":"high"},{"id":"T1608.001","name":"Upload Malware","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware.","confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-broker","vulnerableRanges":[">=5.0.0, <5.1.1"],"patched":["5.1.1"],"from":["GHSA-x3cq-8f32-5f63"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":[">=4.0.0, <4.9.6",">=5.0.0, <5.1.1"],"patched":["4.9.6","5.1.1"],"from":["GHSA-x3cq-8f32-5f63"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-controller","vulnerableRanges":[">=5.0.0, <5.1.1"],"patched":["5.1.1"],"from":["GHSA-x3cq-8f32-5f63"],"provenance":"source"}],"advisories":[{"id":"GHSA-x3cq-8f32-5f63","url":"https://github.com/advisories/GHSA-x3cq-8f32-5f63","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-broker","vulnerableRanges":[">=5.0.0, <5.1.1"],"patched":["5.1.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-x3cq-8f32-5f63","url":"https://github.com/advisories/GHSA-x3cq-8f32-5f63","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":[">=4.0.0, <4.9.6"],"patched":["4.9.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-x3cq-8f32-5f63","url":"https://github.com/advisories/GHSA-x3cq-8f32-5f63","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-controller","vulnerableRanges":[">=5.0.0, <5.1.1"],"patched":["5.1.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-x3cq-8f32-5f63","url":"https://github.com/advisories/GHSA-x3cq-8f32-5f63","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-namesrv","vulnerableRanges":[">=5.0.0, <5.1.1"],"patched":["5.1.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2175","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2175","exploited":true,"exploitedSince":"2023-09-06","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":2,"earliest":"2023-05-30","earliestUrl":"https://github.com/I5N0rth/CVE-2023-33246","repos":[{"name":"SuperZero/CVE-2023-33246","url":"https://github.com/SuperZero/CVE-2023-33246","stars":113,"created":"2023-06-01"},{"name":"Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT","url":"https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT","stars":106,"created":"2023-06-01"},{"name":"Le1a/CVE-2023-33246","url":"https://github.com/Le1a/CVE-2023-33246","stars":81,"created":"2023-06-01"},{"name":"I5N0rth/CVE-2023-33246","url":"https://github.com/I5N0rth/CVE-2023-33246","stars":62,"created":"2023-05-30"},{"name":"vulncheck-oss/fetch-broker-conf","url":"https://github.com/vulncheck-oss/fetch-broker-conf","stars":5,"created":"2023-09-04"}]},"metasploit":[{"name":"Apache RocketMQ update config RCE","module":"exploit/multi/http/apache_rocketmq_update_config","type":"exploit","disclosureDate":"2023-05-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_rocketmq_update_config.rb"}],"nuclei":[{"id":"CVE-2023-33246","name":"RocketMQ <= 5.1.0 - Remote Code Execution","severity":"critical","path":"network/cves/2023/CVE-2023-33246.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2023/CVE-2023-33246.yaml"}],"first":{"date":"2023-05-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_rocketmq_update_config.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html","https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247","https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT","https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1608.001"],"provenance":"source"}],"timeline":[{"date":"2023-05-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-05-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_rocketmq_update_config.rb","provenance":"source"},{"date":"2023-05-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33246","provenance":"source"},{"date":"2023-08-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blogs.juniper.net/en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability","provenance":"source"},{"date":"2023-09-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-09-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2175","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":105},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1159 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-rocketmq-cve-2023-33246","children":[{"from":"CVE-2023-33246","to":"CVE-2023-37582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.","from":"CVE.org","in":"CVE-2023-37582"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.rocketmq:rocketmq-namesrv","fromFixed":"4.9.6","toFixed":"4.9.7","daysApart":49},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.rocketmq:rocketmq-namesrv","fromFixed":"5.1.1","toFixed":"5.1.2","daysApart":49},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-33246","published":"2023-05-24","fixed":"5.1.1","kev":true},{"cve":"CVE-2023-37582","published":"2023-07-12","fixed":"5.1.2","kev":false}],"package":"Maven:org.apache.rocketmq:rocketmq-namesrv"}}