Описание
Shovel DEBUG log of full state exposes decrypted URIs
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_shovel/src/rabbit_shovel_behaviour.erl:220 · Credential Exposure (CWE-532)
Impact
With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map — including decrypted amqp://user:password@host/ URIs — to the broker log file.
Description
?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes.
Exploit scenario
Operator enables DEBUG logging. Shovel 'repl' configured with dest-uri = 'amqp://repl:S3cret@upstream/' and src-delete-after = 1000 completes. Log contains '... uris => ["amqp://repl:S3cret@upstream/"] ...'.
Preconditions
- Shovel plugin enabled with URI-embedded credentials
- DEBUG log level (non-default)
- Autodelete shovel configuration
- Attacker has log read access
CVSS
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (5.6, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6