The rabbitmq-java-client library versions before 5.33.0 contain an unsafe reflection vulnerability (CWE-470) in the com.rabbitmq.tools.jsonrpc.ProcedureDescription class. The vulnerability arises because the javaReturnType value received from an untrusted system.describe response is passed through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass methods to Class.forName(javaReturnType) with initialization enabled. An attacker able to respond to the JsonRpcClient request (e.g., via a shared broker or network interception) can specify a class name already present in the victim JVM, causing its static initializer to execute. Additionally, the getReturnType output is later used in mapper.parse, which may cause type confusion. Successful exploitation can compromise confidentiality, integrity, and availability of the client process. This vulnerability is addressed in rabbitmq-java-client version 5.33.0.

Exploitation allows an attacker with the ability to respond to JsonRpcClient requests to execute static initializers of arbitrary classes in the victim JVM, potentially leading to unauthorized code execution or side effects. This can compromise the confidentiality, integrity, and availability of the client process using the vulnerable library.

This vulnerability is fixed in rabbitmq-java-client version 5.33.0. Users should upgrade to version 5.33.0 or later to remediate this issue. No other official remediation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is in 5.33.0.