PT-2026-80236 · Maven · Com.Rabbitmq:Amqp-Client

Publicado

2026-08-18

·

Atualizado

2026-08-18

CVSS v4.0

7.5

Alta

VetorAV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forName(javaReturnType) with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist.
Vulnerable code (ProcedureDescription.java:101-127): When a JsonRpcClient connects, it calls system.describe and receives a service description from the AMQP queue. The response JSON includes javaReturnType fields that are reflectively set via JSONUtil.tryFill(), triggering setJavaReturnType() → computeReturnTypeAsJavaClass() → Class.forName(javaReturnType).
Attack scenario:
  1. Victim uses JsonRpcClient to connect to a JSON-RPC service via RabbitMQ
  2. Attacker (co-tenant on shared broker, or MITM) intercepts the system.describe request
  3. Attacker responds with crafted javaReturnType values
  4. Victim's client calls Class.forName(attackerInput) with default initialize=true
  5. Static initializers of attacker-specified classes execute in victim's JVM
Additionally, the loaded class from getReturnType() is passed to mapper.parse(replyStr, expectedType) at JsonRpcClient.java:168, potentially enabling type-confusion.
Recommended fix: Use Class.forName(javaReturnType, false, classLoader) to prevent static initializer execution, or add an allowlist of permitted return types.
CWE: CWE-470
Reply from reporter (2026-06-29): Thanks for the quick turnaround. Fix looks good. Looking forward to the CVE assignment.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-470

Identificadores relacionados

GHSA-6G32-PXV4-2WFJ

Produtos afetados

Com.Rabbitmq:Amqp-Client