GHSA-7v84-m3g5-vxq6

Описание

Summary

A SSRF vulnerability exists in the RabbitMQ management plugin's static file handler (rabbit_mgmt_wm_static). When two or more management extension plugins are enabled, URL-encoded backslashes in the request path are decoded by Cowboy's router and passed to Erlang's erl_prim_loader:read_file_info/1 before any path validation occurs. On Windows, this results in a UNC path being resolved by the operating system, triggering outbound DNS lookups and SMB connections to attacker-controlled hosts. The vulnerability requires no authentication.

On domain-joined Windows machines, this coerces the machine account to authenticate over SMB, leaking its NTLMv2 hash, and leading to possible compromise of the RabbitMQ server or other hosts in the network via NTLM relay attacks.

Details

Vulnerable code path (rabbit_mgmt_wm_static.erl, lines 33-43)

The problem: rabbit_mgmt_wm_static calls erl_prim_loader:read_file_info/1 on the unsanitized path before delegating to cowboy_static:init/2, which performs validate_reserved (rejecting \, /, \0 in path segments), fullpath resolution (resolving .. sequences), and directory containment checks.

This clause is only reached when LocalPaths contains 2+ entries (line 33 pattern [{App, Path}|Tail]). With a single entry, the safe clause at line 30 ([{App, Path}]) delegates directly to cowboy_static without any pre-check.

Path construction

1. Cowboy's router (cowboy_router:split_path/1) URL-decodes each path segment per RFC 2396
2. %5C%5C decodes to \\, %5C decodes to \
3. cowboy_req:path_info/1 returns these decoded segments as a list of binaries
4. filename:join/1 concatenates them; on encountering an absolute path (like \\server\share), it discards all prior components and returns the absolute path
5. erl_prim_loader:read_file_info/1 calls into the ERTS prim_file NIF
6. On Windows, the NIF calls GetFullPathNameW (which triggers DNS resolution for UNC paths) followed by GetFileAttributesW (which initiates an SMB connection)

Triggering Conditions

The vulnerable multi-element clause (line 33) is reached when two or more rabbit_mgmt_extension behaviour modules are loaded. The following bundled plugins each contribute one or more extension modules:

The rabbitmq_management module itself contributes rabbit_mgmt_dispatcher. Enabling any one of the above plugins creates 2+ entries in LocalPaths, activating the vulnerable clause.

These plugins are commonly enabled in production deployments, particularly rabbitmq_shovel_management and rabbitmq_federation_management.

PoC

• Install latest Erlang and RabbitMQ (4.2.5) on Windows
• Enable rabbitmq_management plugin and one other management plugin such as rabbitmq_shovel_management. Restart service.
• on attacker machine run a rogue SMB server or responder. I used impacket's example smbserver.py

• coerce an authentication:

• observe target RabbitMQ server connects to attacker controlled SMB server, leaking the NTLM hash of the Active Directory computer account for the RabbitMQ server machine.

In the example below the RabbitMQ server was running on 192.168.4.23 and the attacker is 192.168.4.100:

Impact

This is an unauthenticated blind SSRF vulnerability over SMB port 445.

The impact varies depending on how RabbitMQ is configured. Here are some scenarios:

• Localsystem on domain joined machine (most typical case): The NTLMv2 hash won't be crackable but the coercion can be abused for NTLM relay and chained with a variety of attacks (LDAP relay, RBCD, ESC8, NTLM reflection, etc). In the worst case this leads to administrative access to the RabbitMQ server host or other hosts in the network.
• Domain user service account on domain joined machine: same as above impact except now the service account NTLMv2 hash could also be reasonably cracked, leading to direct compromise of that service account.
• Localsystem on non domain joined machine: impact is marginal here as the service account does not present a real NTLMv2 hash to crack

CVSS scoring is difficult. I opted for Medium severity (High Confidentiality, Low Integrity) though in the worst case it could be High if you assume remote code execution is possible through relay of the machine account.