Loading HuntDB...

GHSA-x3cq-8f32-5f63

GitHub Security Advisory

Apache RocketMQ may have remote code execution vulnerability when using update configuration function

✓ GitHub Reviewed CRITICAL Has CVE

Advisory Details

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. 

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. 

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Affected Packages

Maven org.apache.rocketmq:rocketmq-broker
Affected versions: 5.0.0 (fixed in 5.1.1)
Maven org.apache.rocketmq:rocketmq-namesrv
Affected versions: 4.0.0 (fixed in 4.9.6)
Maven org.apache.rocketmq:rocketmq-controller
Affected versions: 5.0.0 (fixed in 5.1.1)
Maven org.apache.rocketmq:rocketmq-namesrv
Affected versions: 5.0.0 (fixed in 5.1.1)

Related CVEs

Key Information

GHSA ID
GHSA-x3cq-8f32-5f63
Published
July 6, 2023 9:15 PM
Last Modified
January 29, 2025 10:00 PM
CVSS Score
9.0 /10
Primary Ecosystem
Maven
Primary Package
org.apache.rocketmq:rocketmq-broker
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.