PT-2023-6408 · Spring · Spring Amqp

L0Ne1Y

·

Published

2023-10-18

·

Updated

2023-11-04

·

CVE-2023-34050

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Spring AMQP versions 1.0.0 through 2.4.16 Spring AMQP versions 3.0.0 through 3.0.9
Description The issue is related to shortcomings in the deserialization mechanism of the Spring AMQP RabbitMQ application. This could allow a remote attacker to gain unauthorized access to write messages in RabbitMQ. An application is vulnerable if it uses the SimpleMessageConverter or SerializerMessageConverter, the user does not configure allowed list patterns, and untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content.
Recommendations For Spring AMQP versions 1.0.0 through 2.4.16, update to version 2.4.17 or later. For Spring AMQP versions 3.0.0 through 3.0.9, update to version 3.0.10 or later. As a temporary workaround, consider configuring allowed list patterns for deserializable class names to restrict deserialization of data from untrusted sources. Restrict access to the RabbitMQ broker to prevent untrusted message originators from sending malicious content.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

Related Identifiers

BDU:2023-07122
CVE-2023-34050

Affected Products

Spring Amqp