Get in Touch
Indiscriminate, opportunistic targeting.
The Cybersecurity and Infrastructure Security Agency (CISA) added a critical–severity level vulnerability, tracked as CVE-2023-33246 (CVSSv3 score: 9.8), relating to the Apache RocketMQ messaging and streaming platform. Intelligence gathering indicates that there is a possibility that threat actors are actively exploiting this security flaw to install malware payloads on vulnerable systems.
A security researcher discovered that it is possible to exploit the vulnerability due to the fact that several Apache RocketMQ components, including the NameServer and Controller, are exposed to the internet. They were also able to determine that approximately 4,500 systems were exposed via TCP port 9876 which is used by the Apache RocketMQ Nameserver.
Successful exploitation of CVE-2023-33246 could allow a threat actor to use the update configuration function to execute commands as the system users that RocketMQ is running as. This could lead to threat actors gaining remote code execution (RCE) capabilities which would almost certainly result in the compromise and integrity of data.
Apache has released security updates with regards to the product versions affected by the security flaw reported on. As such, previous versions are vulnerable to potential exploitation.
Apache RocketMQ versions 5.1.0 and prior.
Containment, Mitigations & Remediations
To mitigate against the threat posed by this vulnerability, it is strongly recommended that users apply the following updates as a matter of urgency:
- Version 5.1.1 or above for using RocketMQ 5.x
- Version 4.9.6 or above for using RocketMQ 4.x
If it is not possible to apply the updates mentioned above, CISA recommends that impacted products should be discontinued.
Indicators of Compromise
Associated Vulnerability Exploitation IP Addresses:
Associated Vulnerability Exploitation Domains:
Associated Vulnerability Exploitation File Hashes (SHA-256):
Apache RocketMQ occupies a significant proportion of the enterprise application integration market share. Given that threat actors generally utilise a combination of probability and asset value to determine which attack surfaces to focus on, Apache products have become a prime target for threat actors. Due to the fact that enterprise applications are integral aspect of business operations, threat actors will continue to exploit vulnerabilities contained within the associated products in an attempt to extract the sensitive data contained therein.
CVE-2023-33246 has been exploited dating back to June by at least five separate threat actors. Of note, in June 2023, DreamBus botnet operators leveraged the security flaw to deploy a Monero cryptocurrency miner.
DreamBus is a modular malware strain primarily focused on Monero mining. Upon exploitation of CVE-2023-33246, the malware establishes a system service and cron job to maintain persistence within target systems.
Common Weakness Enumeration (CWE):
CWE-94 – Improper Control of Generation of Code (‘Code Injection’)