GHSA-499w-x7r4-fw7p: 
Ruby vulnerability analysis and mitigation

Summary

AMQ::URI.parse returns verify: false for amqps:// URIs that don't set ?verify=. This overrides Bunny's verify_peer: true default, so Bunny.new("amqps://...") connects without certificate and hostname verification.

Details

AMQ::URI::DEFAULTS and AMQ::Settings set verify: false and fail_if_no_peer_cert: false (lib/amq/uri.rb, lib/amq/settings.rb). When the URI has a query string, the TLS option loop also assigns as_boolean(nil), i.e. false, for absent parameters, so a URI with only ?cacertfile=... still yields verify: false. Bunny applies its documented verify_peer: true default only when :verify, :verify_peer and :verify_ssl are all nil (lib/bunny/transport.rb). The false from amq-protocol prevents that. Introduced in 2.3.0 by 1a3f860 ("Parse URI query parameters", December 2017).

Proof of concept

require "amq/uri"
AMQ::URI.parse("amqps://user:pass@broker.example/prod")[:verify]                    # => false, expected nil
AMQ::URI.parse("amqps://user:pass@broker.example/prod?cacertfile=/ca.pem")[:verify] # => false, expected nil
AMQ::URI.parse("amqps://user:pass@broker.example/prod?verify=true")[:verify]        # => true

With amq-protocol 2.9.0 and Bunny 3.4.0, Bunny::Transport#verify_peer is false for the first two URIs.

Impact

Improper certificate validation. An attacker on the network path between an application and its RabbitMQ broker can impersonate the broker and obtain the connection credentials and messages. Affects applications that connect with an amqps:// URI without ?verify=true, for example via RABBITMQ_URL or the URIs that hosted brokers hand out. Workaround: add ?verify=true to the URI (and cacertfile= for a private CA), or pass verify_peer: true to Bunny.new.

Patches

Fixed in amq-protocol 2.10.0. Bunny depends on amq-protocol ~> 2.9, so bundle update amq-protocol is sufficient. This changes behavior: amqps:// connections to brokers with self-signed or private-CA certificates will now fail verification. Add ?cacertfile=/path/to/ca.pem to the URI, or ?verify=false to keep the old (insecure) behavior.