CVE-2023-34050

Summary

In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.

Specifically, an application is vulnerable if

  • the SimpleMessageConverter or SerializerMessageConverter is used

  • the user does not configure allowed list patterns

  • untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content

Affected Software

VendorProductVersion RangeStatus
SpringSpring AMQP1.0.0 < 2.4.17affected
SpringSpring AMQP3.0.0 < 3.0.10affected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References