Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-22097

CVE-2021-22097: Deserialization of Untrusted Data in Spring AMQP

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-22097
GHSA ID
GHSA-fx7f-rjqj-52pj
EPSS Score
0.68185%
CWE
CWE-502
Published
5/24/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.springframework.amqp:spring-amqpmaven>= 2.2.0, <= 2.2.182.2.19
org.springframework.amqp:spring-amqpmaven>= 2.3.0, <= 2.3.102.3.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is directly related to the toString() method's behavior of deserializing the message body. The toString() method is likely overridden in a class such as org.springframework.amqp.core.Message. The precise identification of toString() as vulnerable is based on the vulnerability description.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In Sprin* *MQP v*rsions *.*.* - *.*.** *n* *.*.* - *.*.**, t** Sprin* *MQP M*ss*** o*j**t, in its toStrin*() m*t*o*, will **s*ri*liz* * *o*y *or * m*ss*** wit* *ont*nt typ* *ppli**tion/x-j*v*-s*ri*liz**-o*j**t. It is possi*l* to *onstru*t * m*li*ious

Reasoning

T** vuln*r**ility is *ir**tly r*l*t** to t** `toStrin*()` m*t*o*'s ****vior o* **s*ri*lizin* t** m*ss*** *o*y. T** `toStrin*()` m*t*o* is lik*ly ov*rri***n in * *l*ss su** *s `or*.sprin**r*m*work.*mqp.*or*.M*ss***`. T** pr**is* i**nti*i**tion o* `toS