RabbitMQ XSS attack

Vulnerability

In Pivotal RabbitMQ versions prior to v3.7.18, and RabbitMQ for PCF versions 1.15.x prior to 1.15.13, 1.16.x prior to 1.16.6, and 1.17.x prior to 1.17.3, two components—the virtual host limits page and the federation management UI—fail to properly sanitize user input. This allows a remote authenticated user with administrative access to perform a cross-site scripting (XSS) attack.

Exploitation

An attacker must be authenticated and have administrative access to the RabbitMQ management UI. The attacker crafts a malicious input (e.g., containing JavaScript) in the virtual host limits or federation management interface. When another administrator or the attacker themselves views the affected page, the injected script executes in the context of the user's session.

Impact

A successful XSS attack can result in the attacker gaining access to virtual hosts and policy management information. Depending on the injected script's capabilities, the attacker might steal session tokens, perform actions on behalf of the victim, or extract sensitive configuration details.

Mitigation

Pivotal released fixed versions: RabbitMQ v3.7.18 and RabbitMQ for PCF 1.15.13, 1.16.6, and 1.17.3. Red Hat provided updated packages (e.g., rabbitmq-server-3.7.22-1.el8ost) in RHSA-2020:0078 [1]. Users should upgrade to the patched versions. No workaround other than upgrading is documented.

[1]: https://access.redhat.com/errata/RHSA-2020:0078