Maven · com.rabbitmq:amqp-client
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling ConnectionFactory.useSslProtocol() without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.
com.rabbitmq.client.TrustEverythingTrustManager — accepts any certificatecom.rabbitmq.client.ConnectionFactory.useSslProtocol() — uses TrustEverythingTrustManagerenableHostnameVerification() must be called explicitly)com.rabbitmq.client.ConnectionFactory.getPassword() — returns plaintext with no redaction// TrustEverythingTrustManager accepts ANY certificate including null
TrustEverythingTrustManager tm = new TrustEverythingTrustManager();
tm.checkServerTrusted(null, "RSA"); // No exception — accepts null cert chain
tm.getAcceptedIssuers(); // Returns empty array — trusts all CAs
// ConnectionFactory defaults
ConnectionFactory factory = new ConnectionFactory();
factory.useSslProtocol(); // Uses TrustEverythingTrustManager internally
// enableHostnameVerification() NOT called by default
// Credential exposure
factory.setPassword("secret_password_123");
factory.getPassword(); // Returns "secret_password_123" — no redaction
// Default plaintext port
factory.getPort(); // 5672 (plaintext, not 5671/TLS)
// PLAIN SASL sends cleartext credentials
PlainMechanism pm = new PlainMechanism();
// handleChallenge() sends username+password in cleartext
TrustEverythingTrustManager accepts it → all RabbitMQ traffic interceptedgetPassword() returns plaintext → credentials in logs/stack tracesTrustEverythingTrustManager — it should never be used in productionuseSslProtocol() should use the JVM default trust store, not TrustEverythinggetPassword() or remove the public getterIs your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.