CVE-2023-34050 – Spring AMQP Deserialization Vulnerability

https://notcve.org/view.php?id=CVE-2023-34050

In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content En las versiones Spring AMQP 1.0.0 a 2.4.16 y 3.0.0 a 3.0.9, se agregaron a Spring AMQP patrones de listas permitidas para nombres de clases deserializables, lo que permite a los usuarios bloquear la deserialización de datos en mensajes de fuentes no confiables; sin embargo, de forma predeterminada, cuando no se proporcionaba una lista permitida, se podían deserializar todas las clases. Específicamente, una aplicación es vulnerable si * se utiliza SimpleMessageConverter o SerializerMessageConverter * el usuario no configura los patrones de lista permitidos * los originadores de mensajes que no son de confianza obtienen permisos para escribir mensajes al agente RabbitMQ para enviar contenido malicioso A flaw was found in Spring Framework AMQP. An allowed list exists in Spring AMQP, but when no allowed list is provided, all classes could be deserialized, allowing a malicious user to send harmful content to the broker. • https://spring.io/security/cve-2023-34050 https://access.redhat.com/security/cve/CVE-2023-34050 https://bugzilla.redhat.com/show_bug.cgi?id=2246065 • CWE-502: Deserialization of Untrusted Data •