Описание
Plaintext username:password stored in an insecure cookie after successful POST /login
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Impact
Plaintext credential disclosure. Once recovered, the attacker can use the credentials against any RabbitMQ surface: AMQP 0-9-1 and 1.0, MQTT, STOMP, and the management HTTP API. The credentials are the user's actual login credentials, not a session token, so the leak is not mitigated by token rotation or session expiry.
POST /login is the standard browser flow for the management UI's basic-auth path, and every successful UI login produced this cookie. The cookie was not required by the client-side JavaScript for anything: the JavaScript uses localStorage for credentials (prefs.js:set_basic_auth) plus the LOGGED_IN cookie marker. The auth cookie was dead, write-only state with credential-grade contents.
Description
On a successful credential check inside is_authorized/2, the server set a cookie named auth whose value was base64(<<Username/binary, ":", Password/binary>>):
The cookie was set with no HttpOnly flag, no Secure flag, no SameSite attribute, and no Max-Age and Expires (a default session cookie). It was therefore readable from JavaScript via document.cookie, so any reflected or stored XSS anywhere in the management origin could exfiltrate the plaintext credentials in one network call. It was sent over plaintext HTTP in any deployment that listens on both :15672 and a TLS terminator, or where TLS termination is at a proxy and the back-channel to the broker is plaintext. It was also cross-site by default, because SameSite defaults to browser-dependent behaviour and older browsers default to None. Because base64 is encoding rather than encryption, any holder of the cookie recovers username:password instantly.
Preconditions
There are three distinct attacker positions. An XSS-adjacent attacker exploiting any XSS on the same origin (for example SP-00001, V-00011, V-00044, or any future stored XSS) reads the cookie and recovers the full plaintext credentials; the cookie's lack of HttpOnly is the critical multiplier. A network attacker at any HTTP-readable point between browser and server (a proxy or a shared network) observes the cookie on every authenticated request, since the browser sends it automatically in every Cookie header. A local-machine attacker finds plaintext credentials in the browser cookie store, recoverable from the profile directory or by document.cookie injection.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (8.2, High). Fixed in 4.2.8, 4.3.2.
Пакеты
rabbitmq
>= 4.2.0, < 4.2.8
4.2.8
rabbitmq
>= 4.3.0, < 4.3.2
4.3.2