Aias00 opened a new issue, #2337: URL: https://github.com/apache/rocketmq-dashboard/issues/2337
## Problem The AI message query and trace tools accept an offset-style RocketMQ message ID. The Apache message provider decodes the embedded IP address and port, then directly invokes the RocketMQ remoting client without confirming that the endpoint belongs to the selected instance. This enables an administrator-scoped arbitrary RocketMQ-protocol outbound connection. ## Scope - Resolve/validate decoded broker addresses using selected instance metadata. - Reject message IDs that point outside the instance broker set. - Cover valid in-instance and rejected out-of-instance IDs with regression tests. ## Impact Server-side remoting connections to attacker-selected hosts and ports. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
