2023-06-13 16:10:15 +00:00
|
|
|
id: apache-rocketmq-broker-unauth
|
|
|
|
|
|
|
|
|
|
info:
|
2023-06-13 17:25:54 +00:00
|
|
|
name: Apache Rocketmq Broker - Unauthenticated Access
|
2023-06-13 16:10:15 +00:00
|
|
|
author: j4vaovo
|
2023-07-06 16:52:31 +00:00
|
|
|
severity: high
|
|
|
|
|
description: |
|
|
|
|
|
Apache Rocketmq Unauthenticated Access were detected.
|
2023-06-13 16:10:15 +00:00
|
|
|
reference:
|
2023-07-06 16:52:31 +00:00
|
|
|
- https://rocketmq.apache.org/docs/bestPractice/03access
|
|
|
|
|
metadata:
|
2024-06-07 10:04:29 +00:00
|
|
|
verified: true
|
2023-09-27 13:29:58 +00:00
|
|
|
max-request: 1
|
2023-07-06 16:52:31 +00:00
|
|
|
shodan-query: title:"RocketMQ"
|
2024-06-07 10:04:29 +00:00
|
|
|
fofa-query: protocol="rocketmq"
|
|
|
|
|
tags: network,rocketmq,broker,apache,unauth,misconfig,tcp
|
2023-07-06 16:52:31 +00:00
|
|
|
tcp:
|
2023-06-13 16:10:15 +00:00
|
|
|
- inputs:
|
|
|
|
|
- data: "000000c9000000b17b22636f6465223a32352c226578744669656c6473223a7b224163636573734b6579223a22726f636b65746d7132222c225369676e6174757265223a222b7a6452645575617a6953516b4855557164727477673146386a6b3d227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d746573745f6b65793d746573745f76616c75650a0a"
|
|
|
|
|
type: hex
|
|
|
|
|
|
|
|
|
|
host:
|
|
|
|
|
- "{{Hostname}}"
|
2023-09-16 19:35:21 +00:00
|
|
|
port: 10911
|
2023-06-13 16:10:15 +00:00
|
|
|
read-size: 2048
|
|
|
|
|
|
2023-08-07 14:20:04 +00:00
|
|
|
matchers-condition: and
|
2023-06-13 16:10:15 +00:00
|
|
|
matchers:
|
2023-08-08 17:22:06 +00:00
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- serializeTypeCurrentRPC
|
|
|
|
|
- language
|
|
|
|
|
- opaque
|
|
|
|
|
- version
|
|
|
|
|
condition: and
|
2023-08-08 17:13:47 +00:00
|
|
|
|
2023-08-08 17:22:06 +00:00
|
|
|
- type: word
|
|
|
|
|
words:
|
2023-08-14 09:39:00 +00:00
|
|
|
- "HTTP"
|
|
|
|
|
- "FTP"
|
2023-08-08 17:22:06 +00:00
|
|
|
negative: true
|
2024-06-08 16:02:17 +00:00
|
|
|
# digest: 4a0a00473045022019d7526e23850396a8ae5cfdbbee2cc4cdf751218cba3451af4790386ef1c79f022100c8aa9052d552188fb6462a9fd419c149890c8b048108a5f77d05ed42b5d8674d:922c64590222798bb761d5b6d8e72950
|
