CVE-2023-34050

A flaw was found in Spring Framework AMQP. An allowed list exists in Spring AMQP, but when no allowed list is provided, all classes could be deserialized, allowing a malicious user to send harmful content to the broker.

This flaw requires previous knowledge and access to the messages in order to get them deserialized and possibly leak information. It also requires missing server side configurations to prevent unwanted behavior. Therefore, this is rated as a Moderate impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

An application may be vulnerable if:

• The SimpleMessageConverter or SerializerMessageConverter is used
• The user does not configure allowed list patterns
• Untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content

Make sure these are avoided in order to mitigate the issue.