Apache RocketMQ CVE-2023-33246 (remote command execution through exposed NameServer/Broker/Controller without permission checks, CISA KEV): which versions are fixed and how do I lock down a RocketMQ cluster?

What it is: CVE-2023-33246 affects Apache RocketMQ, the message queue. Disclosed in May 2023, it lets someone who can reach the NameServer, Broker or Controller (which had no permission checks) use the configuration-update function, or forged protocol messages, to run commands as the user RocketMQ runs as. It was exploited in the wild (including by botnets and cryptominers) and CISA added it to the Known Exploited Vulnerabilities catalog in September 2023. Clusters exposed to the internet or to broad internal networks remain at risk. Am I affected: - RocketMQ 5.x up to 5.1.0, or 4.x before 4.9.6. - Check the version from the installed distribution (the lib/rocketmq-*.jar file names or the release directory) or your container image tag, and check whether NameServer, Broker or Controller ports are reachable from outside the hosts that need them. Fix: 1. Upgrade to RocketMQ 5.1.1 or later (5.x) or 4.9.6 or later (4.x), preferably the current release, and update all NameServer, Broker and Controller nodes plus any client and proxy images built on old versions. 2. Never expose NameServer, Broker or Controller to the internet. Restrict them with firewall rules or security groups to the application servers that need them. 3. Turn on RocketMQ's access control (ACL) and run the service as a dedicated unprivileged user, not root. 4. If a vulnerable node was reachable from untrusted networks, check for compromise: unexpected changes to broker configuration (look for odd filter-server or path settings), unknown processes or cron jobs, high CPU from miners, and unexpected outbound connections. Rebuild compromised hosts from clean images and rotate credentials stored on them. Verify: every node reports a fixed version, the RocketMQ ports are unreachable from outside the allowed networks, and ACL is enforced. Sources: https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp https://nvd.nist.gov/vuln/detail/CVE-2023-33246 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246 https://rocketmq.apache.org/release-notes/