Описание
Monitoring-tag user can DELETE shovels
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_shovel_management/src/rabbit_shovel_mgmt_shovel.erl:78 · Broken access control
Impact
A read-only monitoring user can delete or restart any dynamic shovel — a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker.
Description
The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user — intended to have read-only visibility — can therefore delete or restart any shovel in any vhost they can see.
Exploit scenario
User bob has only the monitoring tag. curl -u bob:pw -X DELETE http://broker:15672/api/shovels/vhost/%2F/my-shovel → the shovel is deleted (or with ?restart=true, restarted), disrupting message flow.
Preconditions
- rabbitmq_shovel + rabbitmq_shovel_management plugins enabled
- Attacker has credentials with the
monitoringtag
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N (6.0, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1