PT-2020-9920 · Apache · Apache Rocketmq

Shannonding · Published 2020-05-14 · Updated 2020-07-01 · CVE-2019-17572

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache RocketMQ versions 4.2.0 through 4.6.0

Description The issue arises when automatic topic creation is enabled in the broker by default, allowing an attacker to send a malicious topic name, such as "../../../../topic2020", from the rocketmq-client to the broker. This results in the creation of a topic folder in the parent directory of the broker, leading to a directory traversal issue.

Recommendations For Apache RocketMQ versions 4.2.0 through 4.6.0, upgrade to Apache RocketMQ 4.6.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-17572

GHSA-5X3V-2GXR-59M2

Affected Products

Apache Rocketmq

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-17572 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5x3v-2gxr-59m2 · Vendor Advisory
• https://github.com/apache/rocketmq/issues/1637 · Note
• https://github.com/apache/rocketmq/commit/f8f6fbe4aa7f5dee937e688322628c366b12a552 · Note
• https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEROCKETMQ-569108 · Note
• https://t.me/cibsecurity/12072 · Telegram Post
• https://seclists.org/oss-sec/2020/q2/112 · Note
• https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E · Note