rocketmq-exploit

Apache RocketMQ vulnerability exploitation skills

Exploitation and detection of high-risk vulnerabilities in the Apache RocketMQ distributed messaging platform, covering Broker RCE, NameServer arbitrary file write, and unauthorized Dashboard.

Vulnerability Overview

Vulnerability ID	Affected Versions	Vulnerability Type	Exploitation Conditions	Severity Level
CVE-2023-33246	Broker <=4.9.5, <=5.1.0	Command Injection RCE	No authentication required	Critical (9.8)
CVE-2023-37582	NameServer (incomplete fix)	Arbitrary File Write	No authentication required	High
Unauthorized Dashboard	Improper configuration	Cluster information leakage	Dashboard exposure	Medium

Exploitation Decision Tree

1. 识别RocketMQ → 10911(Broker) / 9876(NameServer) / Dashboard
2. 版本检测 → brokerVersionDesc 提取版本号
   ├── V4.x < V4.9.6 或 V5.x < V5.1.1 → CVE-2023-33246 (Broker RCE)
   └── NameServer可达 → CVE-2023-37582 (任意文件写入)
3. CVE-2023-33246 → 伪造协议 updateBrokerConfig → 注入rocketmqHome → RCE
4. CVE-2023-37582 → UPDATE_NAMESRV_CONFIG → configStorePath覆盖 → 任意文件写入
5. Dashboard未授权 → /cluster/list.query → 集群拓扑泄露

Port and Protocol Quick Reference

Port	Component	Purpose	Key RequestCode
9876	NameServer	Route registration/discovery	318(UPDATE_CONFIG), 319(GET_CONFIG)
10911	Broker	Message sending and receiving	25(UPDATE_CONFIG), 28(CLUSTER_INFO)
10909	Broker HA	Primary-secondary synchronization	-
8080	Dashboard	Management interface (optional)	HTTP `/cluster/list.query`

Protocol packet structure: [4字节总长度(大端)][4字节header长度(大端)][JSON header][body]

Exploitation chain priority

1. CVE-2023-33246 → Broker无认证命令注入 → 直接RCE
2. CVE-2023-37582 → NameServer配置修改 → 任意文件写入 → SSH公钥/Cron RCE
3. Dashboard未授权 → 版本/拓扑泄露 → 辅助精准利用

Identifying characteristics

FOFA: app="Apache-RocketMQ" or title="RocketMQ"
Shodan: port:10911 or port:9876 "rocketmq"
Response characteristics: The heartbeat response JSON on port 10911 contains brokerVersionDesc

About this skill