Metasploit Weekly Wrap-Up

Apache RocketMQ

We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246.

In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without authentication. From here

access access control apache authentication configuration control cve exploit file great issue metasploit metasploit weekly wrapup teamwork under update version week weekly wrap-up