From 8871b8acd136bf4a2a866fd13deeb64e01a4f244 Mon Sep 17 00:00:00 2001
From: pussycat0x <65701233+pussycat0x@users.noreply.github.com>
Date: Thu, 6 Jul 2023 22:22:31 +0530
Subject: [PATCH] protocol & metadata -update

---
 network/apache-rocketmq-broker-unauth.yaml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/network/apache-rocketmq-broker-unauth.yaml b/network/apache-rocketmq-broker-unauth.yaml
index a0dcbd1f91..da8b0d2a59 100644
--- a/network/apache-rocketmq-broker-unauth.yaml
+++ b/network/apache-rocketmq-broker-unauth.yaml
@@ -3,12 +3,18 @@ id: apache-rocketmq-broker-unauth
 info:
   name: Apache Rocketmq Broker - Unauthenticated Access
   author: j4vaovo
-  severity: critical
-  description: Apache Rocketmq Unauthenticated Access.
+  severity: high
+  description: |
+    Apache Rocketmq Unauthenticated Access were detected.
   reference:
+    - https://rocketmq.apache.org/docs/bestPractice/03access
+  metadata:
+    verified: true
+    fofa-query: protocol="rocketmq"
+    shodan-query: title:"RocketMQ"
   tags: network,rocketmq,broker,apache,unauth
 
-network:
+tcp:
   - inputs:
       - data: "000000c9000000b17b22636f6465223a32352c226578744669656c6473223a7b224163636573734b6579223a22726f636b65746d7132222c225369676e6174757265223a222b7a6452645575617a6953516b4855557164727477673146386a6b3d227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d746573745f6b65793d746573745f76616c75650a0a"
         type: hex