Описание
Admin-only atom exhaustion: PUT /api/users tags list
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbit/src/rabbit_auth_backend_internal.erl:853 · Atom Table Exhaustion
Impact
An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag strings.
Description
set_tags/2 maps rabbit_data_coercion:to_atom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. Admin-only.
Exploit scenario
PUT /api/users/x body {"password":"x","tags":"t0000001,t0000002,...,t3000000"}. VM aborts.
Preconditions
- administrator tag
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.9, Moderate). Fixed in 4.0.22, 4.1.14, 4.2.7, 4.3.0.
Пакеты
rabbitmq
>= 4.0.0, < 4.0.22
4.0.22
rabbitmq
>= 4.1.0, < 4.1.14
4.1.14
rabbitmq
>= 4.2.0, < 4.2.7
4.2.7