CVE-2023-34050
Spring AMQP Deserialization Vulnerability
Résumé
Spring AMQP Deserialization Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.
Specifically, an application is
vulnerable if
-
the
SimpleMessageConverter or SerializerMessageConverter is used -
the user
does not configure allowed list patterns -
untrusted
message originators gain permissions to write messages to the RabbitMQ
broker to send malicious content
Références
- advisory github.com
- advisory nvd.nist.gov
- web spring.io