In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Description: CWE-330: Use of Insufficiently Random Values
Metrics
Version
Base score
Base severity
Vector
3.1
4.4
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Version:3.1
Base score:4.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC ID
Description
N/A
An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts.
CAPEC ID: N/A
Description: An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts.