GHSA-qx7j-jv8m-fppr

Dashboard / Vulnerabilities / GHSA-qx7j-jv8m-fppr

GHSA-qx7j-jv8m-fppr

Summary: RabbitMQ Java client malformed body frame triggers raw command assembler exception

Details: ### Summary RabbitMQ Java Client's inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw `UnsupportedOperationException` from `CommandAssembler`. A broker peer that the client has connected to can use this malformed frame sequence to fail frame processing and tear down the client connection instead of receiving a clean protocol-level malformed-frame error. This was discovered based on an existing vulnerability CVE-2017-15699. ### Details Inbound frames enter the client through `SocketFrameHandler.readFrame`, which returns frames parsed from the peer-controlled input stream (`src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java:197`). `AMQConnection.MainLoop` reads each frame (`src/main/java/com/rabbitmq/client/impl/AMQConnection.java:692`) and dispatches non-zero-channel frames to the channel while the connection is open (`src/main/java/com/rabbitmq/client/impl/AMQConnection.java:748` and `src/main/java/com/rabbitmq/client/impl/AMQConnection.java:766`). The channel then passes the frame to the current command assembler through `AMQChannel.handleFrame` and `AMQCommand.handleFrame` (`src/main/java/com/rabbitmq/client/impl/AMQChannel.java:121`, `src/main/java/com/rabbitmq/client/impl/AMQCommand.java:114`). When a content-bearing method is followed by a content header, `CommandAssembler.consumeHeaderFrame` records the header's declared body size in `remainingBodyBytes` after only checking it against the configured maximum (`src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:126` through `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:139`). The body-frame path subtracts the received payload length from that remaining count before validating that the payload fits (`src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:145` through `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:149`), so a body frame larger than the declared size drives the count negative and reaches the raw `UnsupportedOperationException` at `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:150` and `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:151`. `AMQConnection` catches the resulting throwable in frame processing and performs connection failure handling and final shutdown (`src/main/java/com/rabbitmq/client/impl/AMQConnection.java:695` through `src/main/java/com/rabbitmq/client/impl/AMQConnection.java:705`). ### PoC [poc.zip](https://github.com/user-attachments/files/28182717/poc.zip) ```bash bash ./poc/run.sh ``` ```text Exception in thread "main" java.lang.UnsupportedOperationException: %%%%%% FIXME unimplemented ``` The `UnsupportedOperationException: %%%%%% FIXME unimplemented` fingerprint is the raw exception thrown at the negative `remainingBodyBytes` check in `CommandAssembler.consumeBodyFrame`. This line shows the malformed declared-size/body-size sequence reached the vulnerable assembler path. ### Impact The attacker model is a remote AMQP broker peer that the RabbitMQ Java Client application has accepted, including a malicious broker endpoint, a compromised broker, or routing that sends the client to an attacker-controlled peer. The peer needs a non-zero open channel that can receive a content-bearing server-to-client method such as `basic.deliver`, then sends the method frame, a content header declaring a body below the configured maximum, and a body frame whose payload exceeds that declared size. Under those conditions, the peer can force frame processing to fail with `UnsupportedOperationException` and close the AMQP connection, producing a client-side denial of service for work depending on that connection; the finding does not indicate memory corruption, data disclosure, or code execution.

References: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr, https://github.com/rabbitmq/rabbitmq-java-client/pull/1959, https://github.com/rabbitmq/rabbitmq-java-client/pull/1960, https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322, https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b, https://github.com/rabbitmq/rabbitmq-java-client, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0