GHSA-2rf7-f6r6-8rwh

Описание

Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Impact

Arbitrary JavaScript execution in the management UI's origin when the victim's browser fetches bootstrap.js. The script runs in the same JavaScript realm as the rest of the management UI, giving it full HTTP-API access via the administrator's existing session, including creating new administrator users, exfiltrating definitions, and modifying policies. This is the same blast radius as V-00011 and V-00044 (stored cert-DN XSS) and the canonical browser-side worst case for the management UI.

The endpoint runs unauthenticated by design, because it bootstraps the OAuth UI before login, so the cross-site scripting is reachable pre-auth in OAuth-enabled deployments. Any deployment with management.oauth_enabled = true is exposed when an attacker can place a cookie on the host.

Description

set_token_auth/2 emits JavaScript by string-concatenating an attacker-influenced bearer token directly between single quotes:

The Token flows from one of two untrusted inputs without any escaping or validation: the Authorization: Bearer <Token> header parsed by cowboy_req:parse_header(<<"authorization">>, Req0), whose value is untouched after parsing, and the access_token cookie parsed by cowboy_req:parse_cookies/1, whose value is also untouched. Any token containing ', </script>, or a newline breaks out of the JavaScript string literal and yields arbitrary JavaScript executed in the management-UI origin.

Preconditions

Exploitation requires an attacker who can plant an access_token cookie on the management host, for example via a sibling subdomain that can write a host-only cookie, or by tricking a victim into visiting a controlled page that performs a cookie-setting redirect through a permissive parent endpoint. The Authorization-header path is harder to weaponise from the browser, but is reachable from any non-browser client that mediates an attacker-controlled request.

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (7.5, High). Fixed in 4.2.8, 4.3.2.