BleepingComputer reports that internet-exposed Apache RocketMQ servers vulnerable to the critical remote code execution flaws, tracked as CVE-2023-33246 and CVE-2023-37582 the latter of which stemmed from the incomplete fix of the former were discovered by The ShadowServer Foundation to have been scanned by hundreds of hosts around the world daily for attempted exploitation. Exploitation of CVE-2023-33246 could enable command execution through NameServer’s update configuration function in the event of address exposure and the lack of permission checks, according to Apache RocketMQ Project Management Committee member and Alibaba Research and Development Engineer Rongtong Jin.

Source: SC Magazine