PT-2026-80236

تاريخ النشر

2026-08-18

·

تاريخ التحديث

2026-08-18

الوصف من

CVSS 4.0
7.5
عالية
المقاييسAV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forName(javaReturnType) with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist.
Vulnerable code (ProcedureDescription.java:101-127): When a JsonRpcClient connects, it calls system.describe and receives a service description from the AMQP queue. The response JSON includes javaReturnType fields that are reflectively set via JSONUtil.tryFill(), triggering setJavaReturnType() → computeReturnTypeAsJavaClass() → Class.forName(javaReturnType).
Attack scenario:
  1. Victim uses JsonRpcClient to connect to a JSON-RPC service via RabbitMQ
  2. Attacker (co-tenant on shared broker, or MITM) intercepts the system.describe request
  3. Attacker responds with crafted javaReturnType values
  4. Victim's client calls Class.forName(attackerInput) with default initialize=true
  5. Static initializers of attacker-specified classes execute in victim's JVM
Additionally, the loaded class from getReturnType() is passed to mapper.parse(replyStr, expectedType) at JsonRpcClient.java:168, potentially enabling type-confusion.
Recommended fix: Use Class.forName(javaReturnType, false, classLoader) to prevent static initializer execution, or add an allowlist of permitted return types.
CWE: CWE-470
Reply from reporter (2026-06-29): Thanks for the quick turnaround. Fix looks good. Looking forward to the CVE assignment.
قابلية الاستغلال
إصلاح
المورّدون
المنتجات المتأثرة
تصنيف نقاط الضعف
CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')
المعرّفات ذات الصلة
GHSA-6G32-PXV4-2WFJ
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com