CVE-2025-30219

Vulnerability

Overview

RabbitMQ versions prior to 4.0.3 are vulnerable to a stored cross-site scripting (XSS) flaw in the management UI. When a virtual host fails to start, the error notification includes the virtual host name without proper escaping. An attacker who can modify the virtual host name on disk (e.g., by altering configuration files) and cause the virtual host to fail to start can inject arbitrary JavaScript code into the error message [1].

Exploitation

Prerequisites

Exploitation requires a sophisticated attack chain: the attacker must first gain the ability to modify virtual host names on disk (e.g., through file write access or other means) and then trigger a failure for that virtual host. The injected JavaScript executes in the browsers of management UI users who view the error notification. No authentication is needed to view the management UI if it is exposed, but the attacker needs prior access to modify on-disk data [1].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the management UI. This could allow an attacker to perform actions on behalf of an authenticated administrator, steal session tokens, or deface the interface. The CVSS v3.1 base score is 6.1 (Medium), reflecting the need for prior access to modify files [1].

Mitigation

The vulnerability is patched in open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3 and 3.13.8. Users unable to upgrade can disable the management plugin and rely on Prometheus and Grafana for monitoring as a workaround [1].