CVE-2023-34050: Spring AMQP Deserialization Vulnerability

CVE-2023-34050 Overview

CVE-2023-34050 is an insecure deserialization vulnerability affecting VMware Spring Advanced Message Queuing Protocol (Spring AMQP). In Spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9, allowed list patterns for deserializable class names were added to provide security controls; however, by default when no allowed list was provided, all classes could be deserialized. This allows attackers with the ability to write messages to the RabbitMQ broker to send malicious serialized content that could be deserialized by vulnerable applications.

Critical Impact

Applications using SimpleMessageConverter or SerializerMessageConverter without configuring allowed list patterns are vulnerable to deserialization attacks from untrusted message originators who gain write permissions to the RabbitMQ broker.

Affected Products

• VMware Spring Advanced Message Queuing Protocol versions 1.0.0 to 2.4.16
• VMware Spring Advanced Message Queuing Protocol versions 3.0.0 to 3.0.9

Discovery Timeline

• October 19, 2023 - CVE-2023-34050 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-34050

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) exists in Spring AMQP's message handling mechanism. The vulnerability occurs when applications use the SimpleMessageConverter or SerializerMessageConverter classes to process incoming messages without properly configuring class deserialization restrictions.

Spring AMQP introduced allowed list patterns as a security feature to restrict which classes can be deserialized from incoming messages. However, the default configuration does not enforce any restrictions, meaning all classes are allowed to be deserialized. This design flaw creates a significant attack surface when untrusted parties can write messages to the RabbitMQ broker.

For exploitation to succeed, three conditions must be met: the application must use SimpleMessageConverter or SerializerMessageConverter, no allowed list patterns must be configured, and an attacker must have permissions to write messages to the RabbitMQ broker. While the attack requires authenticated access to the message broker, it can lead to unauthorized data manipulation.

Root Cause

The root cause of this vulnerability is a permissive default configuration in Spring AMQP's deserialization mechanism. When allowed list patterns were introduced as a security feature, the implementation defaulted to allowing all classes when no explicit configuration was provided. This "open by default" approach contradicts secure design principles, which recommend denying by default and explicitly allowing only trusted classes.

Attack Vector

The attack is network-based and requires an authenticated attacker with low privileges to have write access to the RabbitMQ broker. The attacker crafts a malicious serialized Java object and sends it as a message to a queue monitored by the vulnerable application. When the application's message converter deserializes the message content without class restrictions, the malicious payload is processed.

The exploitation requires the attacker to identify a suitable gadget chain present in the application's classpath that can be leveraged during deserialization to achieve the desired impact, such as modifying application state or manipulating data.

Detection Methods for CVE-2023-34050

Indicators of Compromise

• Unexpected or malformed serialized Java objects appearing in RabbitMQ message queues
• Unusual message patterns from unexpected sources writing to protected queues
• Application errors or exceptions related to class instantiation during message processing
• Anomalous RabbitMQ connection attempts from unauthorized IP addresses or services

Detection Strategies

• Monitor RabbitMQ audit logs for unauthorized write attempts to application queues
• Implement application-level logging to track deserialization operations and identify suspicious class instantiations
• Deploy network monitoring to detect unusual traffic patterns to RabbitMQ broker ports
• Review application configurations to identify instances using default converter settings without allowed lists

Monitoring Recommendations

• Enable verbose logging for Spring AMQP message converter operations
• Configure RabbitMQ to log all producer connections and message publishing events
• Implement alerting for deserialization exceptions that may indicate exploitation attempts
• Regularly audit RabbitMQ user permissions to ensure principle of least privilege

How to Mitigate CVE-2023-34050

Immediate Actions Required

• Upgrade Spring AMQP to versions 2.4.17 or later for the 2.x branch, or 3.0.10 or later for the 3.x branch
• Configure explicit allowed list patterns for all SimpleMessageConverter and SerializerMessageConverter instances
• Review and restrict RabbitMQ user permissions to limit write access to only authorized producers
• Audit all Spring AMQP configurations across applications to identify vulnerable deployments

Patch Information

VMware has released patched versions of Spring AMQP that address this vulnerability. Organizations should upgrade to Spring AMQP version 2.4.17 or later for applications on the 2.x branch, or version 3.0.10 or later for applications on the 3.x branch. For detailed patch information, refer to the Spring Security Advisory CVE-2023-34050.

Workarounds

• Configure explicit allowed list patterns on message converters to restrict deserializable classes to only those required by the application
• Replace SimpleMessageConverter or SerializerMessageConverter with Jackson2JsonMessageConverter which uses JSON instead of Java serialization
• Implement network segmentation to restrict access to RabbitMQ brokers from untrusted networks
• Add message validation layers before deserialization to filter suspicious content

# Example: Configure allowed list patterns in Spring configuration
# Add to application.properties or application.yml

# Restrict deserialization to specific packages
spring.rabbitmq.listener.simple.message-converter.allowed-list-patterns=com.yourcompany.model.*,java.util.*