RabbitMQ XSS attack via federation and shovel endpoints

The vulnerability resides in the federation and shovel management endpoints of RabbitMQ, which fail to properly sanitize user-supplied input in the vhost or node name fields. This oversight allows a remote, authenticated user with administrative privileges to inject arbitrary HTML or JavaScript, leading to a stored cross-site scripting (XSS) condition [1][2].

Exploitation requires an attacker to have administrative access to the RabbitMQ management interface. The attacker can craft malicious input in the vhost or node name fields, which is then reflected or stored without sanitization. When other administrators view the affected management pages, the injected script executes in their browser context, enabling the attacker to perform actions on their behalf [1].

Successful XSS can grant the attacker access to virtual hosts and policy management information. While the attacker already has administrative privileges, the XSS could be used to escalate privileges within the management UI or to steal sensitive configuration data from other administrators [1].

Red Hat has rated this issue as Low severity and released updated packages (rabbitmq-server 3.7.23-2) for Red Hat OpenStack Platform 15 [2]. Pivotal has fixed the issue in RabbitMQ 3.7.20 and 3.8.1, and in RabbitMQ for PCF versions 1.16.7 and 1.17.4. Users are advised to upgrade to the patched versions to mitigate this vulnerability [1].