PT-2026-80236 · Maven · Com.Rabbitmq:Amqp-Client

Published

2026-08-18

·

Updated

2026-08-18

CVSS v4.0

7.5

High

VectorAV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forName(javaReturnType) with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist.
Vulnerable code (ProcedureDescription.java:101-127): When a JsonRpcClient connects, it calls system.describe and receives a service description from the AMQP queue. The response JSON includes javaReturnType fields that are reflectively set via JSONUtil.tryFill(), triggering setJavaReturnType() → computeReturnTypeAsJavaClass() → Class.forName(javaReturnType).
Attack scenario:
  1. Victim uses JsonRpcClient to connect to a JSON-RPC service via RabbitMQ
  2. Attacker (co-tenant on shared broker, or MITM) intercepts the system.describe request
  3. Attacker responds with crafted javaReturnType values
  4. Victim's client calls Class.forName(attackerInput) with default initialize=true
  5. Static initializers of attacker-specified classes execute in victim's JVM
Additionally, the loaded class from getReturnType() is passed to mapper.parse(replyStr, expectedType) at JsonRpcClient.java:168, potentially enabling type-confusion.
Recommended fix: Use Class.forName(javaReturnType, false, classLoader) to prevent static initializer execution, or add an allowlist of permitted return types.
CWE: CWE-470
Reply from reporter (2026-06-29): Thanks for the quick turnaround. Fix looks good. Looking forward to the CVE assignment.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-470

Related Identifiers

GHSA-6G32-PXV4-2WFJ

Affected Products

Com.Rabbitmq:Amqp-Client