RabbitMQ Management OAuth Stored HTML Injection Credential Theft

Stored HTML Injection Vulnerability in RabbitMQ Management Interface OAuth Error Handling Vulnerability Overview Vulnerability Type: Stored HTML Injection Description: When the OAuth management UI is enabled, the RabbitMQ management interface renders AMQP authorization failure reasons as HTML. An attacker can configure a queue name containing an HTML element. When a management administrator views this queue and clicks , the queue name is returned with an reason and inserted into the page, causing an HTML escape. Attack Principle: 1. The attacker creates a queue name containing malicious HTML (e.g., ). 2. A management administrator accesses the queue page and clicks . 3. The server returns an error containing the queue name. 4. The error message is rendered into the page without HTML escaping. 5. The injected tag alters the document's base URL. 6. The management UI's auto-refresh mechanism (every 5 seconds) sends requests using relative URLs, which are now resolved to the attacker-controlled domain. 7. The requests carry the administrator's header (Basic or Bearer credentials). 8. The attacker captures the administrator credentials and can perform management operations. CVSS Score: 7.1 (Medium) Impact Scope Affected Versions: Fixed Versions: 3.13.19 4.0.24 4.1.15 4.2.10 4.3.5 Exploitation Prerequisites: The RabbitMQ Management Plugin is available. OAuth Management UI is enabled. The attacker possesses valid RabbitMQ credentials and has vhost permissions configured. The attacker can create queues. A management administrator can view the queue but lacks AMQP read permissions. The administrator opens the queue page and clicks . The attacker controls an HTTP endpoint that is allowed by the management interface's CORS settings. The management UI auto-refresh is enabled (default 5 seconds). Potential Impact: Stealing administrator credentials. Modifying queues, exchanges, definitions, users, and broker metadata. Deleting queues, exchanges, users, or policies. Performing destructive management operations using stolen credentials. Remediation Primary Fix HTML-escape warning messages in the template: Hardening Strengthen the default management interface Content Security Policy (CSP): Explanation: prevents the injection of base elements. should be restricted to the management interface, configured OAuth providers, and broker endpoints, rejecting arbitrary domains. A strict policy prevents the OAuth flow from contacting external identity providers. Mitigation Prevention via configuration before the patch is available: Other mitigation measures include: Disabling the OAuth management UI if not required. Avoiding granting additional queue read permissions to high-privilege management sessions. Detection Indicators Queue or exchange names containing HTML delimiters or tags (e.g., ). Management API 401 responses containing queue operations. Unexpected CORS preflight requests from cross-origin browsers. Administrator API activity shortly after originating from a new source. Related Code Locations - Constructs the ACCESS_REFUSED reason. - Forwards the reason to the HTTP response. - Serializes the reason to 401 JSON. - Sends the raw OAuth authorization reason to the log renderer. - Inserts the reason into the warning array. - Renders the warning without an escaping helper function. - Configures the default 5-second refresh. - Executes partial refreshes when elements are present. - Opens the relative API URL and appends the authorization header. - Stores and restores Basic or Bearer credentials. - Defines the default CSP without or .

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ Management OAuth Stored HTML Injection Credential Theft

More from this source