Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client, affecting all versions up to and including 2.3.0 [1][3]. The client performs unbounded deserialization of responses from AMQP servers, which can be exploited by a malicious server to craft responses leading to arbitrary code execution on the client side [1][3].

To exploit this vulnerability, an attacker must control a malicious AMQP server that the client connects to. Although version 2.1.0 introduced allow/deny lists to restrict deserialization, these protections were found to be bypassable under certain conditions [1][3]. No authentication is required from the attacker's perspective; the client initiates the connection.

Successful exploitation allows an attacker to execute arbitrary code on the client machine, potentially compromising the system and data [1]. The impact is considered important due to the possibility of remote code execution.

Mitigation: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue [1][3]. Additionally, as Microsoft has deprecated binary serialization in .NET 9, the project recommends migrating away from .NET binary serialization as part of a long-term hardening strategy [1][3].