GHSA-6jfq-prw2-7rwp

Описание

Summary

A stored Cross-Site Scripting (XSS) vulnerability in the RabbitMQ management UI allows any user with permissions to declare a queue or exchange to execute arbitrary JavaScript in the browser of any user viewing the Queues or Exchanges page.

Details

The vulnerability exists because the value of the x-internal-purpose queue/exchange argument is rendered directly into an HTML title attribute without proper escaping.

The attack flow is as follows:

1. Source (Payload acceptance): An attacker declares a queue or exchange with a malicious x-internal-purpose argument. The RabbitMQ server code in deps/rabbit/src/rabbit_amqqueue.erl does not validate this unknown argument, so it is accepted and stored as-is in the queue's metadata.

2. API (Unsanitized transport): When the management UI requests the list of queues from GET /api/queues, the server includes the full, unsanitized arguments map in the JSON response.

3. Sink (Unescaped rendering): The UI's JavaScript in deps/rabbitmq_management/priv/www/js/formatters.js uses the _link_to function to create links for the queue list. This function concatenates the x-internal-purpose value directly into the link's title attribute, without using an HTML-escaping function.

   // File: deps/rabbitmq_management/priv/www/js/formatters.js function _link_to(name, url, highlight, args) { if (highlight == undefined) highlight = true; var title = null; if (args != undefined && args['x-internal-purpose'] != undefined) { var purpose = args['x-internal-purpose']; // 'purpose' is not escaped before concatenation title = 'This is used internally by the ' + purpose + ' mechanism.'; } return '<a href="' + url + '"' + (title ? ' title="' + title + '"' : '') + '>' + '</a>'; }

   An attacker can provide a payload for purpose that starts with a double quote (") to break out of the title attribute and close the <a> tag, then inject an <img> tag with an onerror handler that executes arbitrary JavaScript.

4. Permissive CSP: The default Content-Security-Policy (CSP) found in deps/rabbitmq_management/Makefile includes 'unsafe-inline', which permits the execution of injected inline event handlers, making the XSS payload execution possible.

Impact

The XSS payload is persisted on the server and will execute for any user who views the page until the malicious queue or exchange is deleted creating a stored XSS vulnerability.