Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.rabbitmq:amqp-client | maven | < 5.33.0 | 5.33.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the RabbitMQ Java client, prior to version 5.33.0, used a TrustEverythingTrustManager by default when a user enabled SSL via ConnectionFactory.useSslProtocol(). This trust manager has an empty implementation for checkServerTrusted, meaning it accepts any certificate presented by the server, including self-signed or invalid ones. This, combined with hostname verification being disabled by default, makes any application using this default configuration trivially vulnerable to a Man-in-the-Middle (MITM) attack. An attacker could intercept the connection, present their own certificate, and the client would accept it without question, allowing the attacker to decrypt and tamper with all traffic.
The patch addresses this by changing the default behavior of useSslProtocol(). It now uses the JVM's default SSLContext and TrustManagerFactory, which perform standard certificate and hostname validation. The old, insecure behavior is still available for development purposes but has been moved to a new, explicitly named method, useTlsWithNoVerification(), which also logs a prominent security warning when used. The analysis of the commit patches confirms these changes in ConnectionFactory.java and the related modifications to restrict the use of TrustEverythingTrustManager.
com.rabbitmq.client.ConnectionFactory.useSslProtocolsrc/main/java/com/rabbitmq/client/ConnectionFactory.java
com.rabbitmq.client.ConnectionFactory.useSslProtocol(String)src/main/java/com/rabbitmq/client/ConnectionFactory.java
com.rabbitmq.client.TrustEverythingTrustManager.checkServerTrustedsrc/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java
com.rabbitmq.client.ConnectionFactoryConfigurator.setUpBasicSslsrc/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java