Security researchers are detecting hundreds of IP addresses on a daily basis that scan or attempt to exploit Apache RocketMQ services vulnerable to a remote command execution flaw identified as CVE-2023-33246 and CVE-2023-37582.
Both vulnerabilities have a critical severity score and refer to an issue that remained active after the vendor's initial patch in May 2023.
Initially, the security issue was tracked as CVE-2023-33246 and impacted multiple components, including NameServer, Broker, and Controller.
Apache released a fix that was incomplete for the NameServer component in RocketMQ and continued to affect versions 5.1 and older of the distributed messaging and streaming platform.
On vulnerable systems, attackers can leverage the vulnerability to execute commands by using the update configuration function on the NameServer when its address is exposed online without proper permission checks.
The issue is now referred to as CVE-2023-37582 and it is recommended to upgrade the NameServer to version 5.1.2/4.9.7 or above for RocketMQ 5.x/4.
Threat tracking platform The ShadowServer Foundation has logged hundreds of hosts scanning for RocketMQ systems exposed online, some of them attempting to exploit the two vulnerabilities.
ShadowServer says that the activity it observes may be part of reconnaissance attempts from potential attackers, exploitation efforts, or even researchers scanning for exposed endpoints.
Hackers started targeting vulnerable Apache RocketMQ systems since at least August 2023, when a new version of the DreamBus botnet was observed leveraging an CVE-2023-33246 exploit to drop XMRig Monero miners on vulnerable servers.
In September 2023, the U.S. Cybersecurity and Infrastructure Security Agency urged federal agencies to patch the flaw by the end of the month, warning about its active exploitation status.
Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers.
Hackers are exploiting critical Apache Struts flaw using public PoC. Sophos backports RCE fix after attacks on unsupported firewalls.
New botnet malware exploits two zero-days to infect NVRs and routers.
Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 05 Jan 2024 17:36:06 +0000