CVE-2023-34050 PoC — Spring AMQP Deserialization Vulnerability

Source

https://github.com/X1r0z/spring-amqp-deserialization

Associated Vulnerability

Title:Spring AMQP Deserialization Vulnerability (CVE-2023-34050)
Description: In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content

Description

A Proof of Concept of Spring AMQP Deserialization Vulnerability (CVE-2023-34050)

Readme

# spring-amqp-deserialization

A Proof of Concept of Spring AMQP Deserialization Vulnerability (CVE-2023-34050)

Affected versions:
- 1.0.0 to 2.4.16
- 3.0.0 to 3.0.9

Reference: [https://spring.io/security/cve-2023-34050](https://spring.io/security/cve-2023-34050)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!