Arbitrary Code Injection

org.apache.rocketmq, rocketmq-namesrv is vulnerable to Remote Code Execution (RCE). The vulnerability exists because the library allows updating the config path at runtime, allowing an attacker to inject and execute malicious code through the update configuration function by forging the RocketMQ protocol content, which also leads to information leakage in the extranet. This issue was not completely fixed in CVE-2023-33246, thus a new CVE was issued.