Описание
list_to_atom on auth_mechanism URI tokens in amqp_client
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Description
mechanisms/1 calls [list_to_atom(T) || T <- string:tokens(Mech, ":")] on every auth_mechanism query value. A single ~9 MB PUT fits roughly 1M colon-separated tokens, and each becomes a permanent atom, crashing the node in one to three requests.
Preconditions
The Shovel or Federation plugin must be in use. Setting auth_mechanism requires the policymaker tag.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (5.9, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6