GHSA-f9f2-q3jf-wfj3

Описание

Summary

When OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauth_client_secret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without authentication.

Workarounds

One of:

• Avoid using the OAuth 2 flow that needs a client secret
• Disable rabbitmq_management and use the Prometheus plugin for monitoring
• Switch from rabbitmq_auth_backend_oauth2 to any other authN/authZ backend

Vulnerability Details

Files:

• deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl, line 186
• deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl, lines 35-50
• deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl, lines 45-49 (route registration)

Code Path:

1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbit_mgmt_dispatcher.erl:46):

2. The handler rabbit_mgmt_oauth_bootstrap does NOT implement Cowboy REST's is_authorized/2 callback — it's a plain handler with only init/2 (rabbit_mgmt_oauth_bootstrap.erl:35):

3. bootstrap_oauth calls rabbit_mgmt_wm_auth:authSettings() and embeds the result in JavaScript (rabbit_mgmt_oauth_bootstrap.erl:40-50):

4. authSettings() explicitly includes oauth_client_secret (rabbit_mgmt_wm_auth.erl:186):

Attack Scenario

1. Administrator configures management.oauth_client_secret = my-confidential-secret in RabbitMQ config
2. Any unauthenticated user sends: GET /js/oidc-oauth/bootstrap.js
3. Response contains JavaScript: set_oauth_settings({"oauth_enabled":true,...,"oauth_client_secret":"my-confidential-secret",...});
4. Attacker extracts oauth_client_secret from the response

With the client secret, an attacker can:

• Exchange stolen authorization codes for access tokens at the token endpoint
• Impersonate the RabbitMQ management UI to the OAuth2 provider
• Potentially access user data or other resources authorized to the client
• Perform token exchange attacks if the OAuth2 provider supports it

Impact

• Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication
• Token theft: Attacker can complete the authorization code flow using stolen authorization codes
• Client impersonation: Attacker can make requests to the OAuth2 provider as the RabbitMQ management UI client
• Scope escalation: If the client has additional scopes beyond what the management UI uses, attacker gains access to those scopes

Affected Configuration

Any RabbitMQ deployment with:

1. Management UI enabled (rabbitmq_management plugin)
2. OAuth2 authentication enabled (management.oauth_enabled = true)
3. management.oauth_client_secret configured

Workarounds

One of:

1. Switch to different setup or IDP, avoiding client secret flow use entirely
2. Disable the rabbitmq_auth_backend_oauth2 plugin and use a different

Steps to Reproduce

1. Configure RabbitMQ with OAuth2 for management UI:

2. Without authenticating, request:

3. Response contains:

Workaround

One of the following:

1. Switch to an OAuth 2 flow that does not require a client secret
2. Disable rabbitmq_auth_backend_oauth2 and use one of the other supported authN, authZ options

Suggested Fix

Remove oauth_client_secret from the auth settings served to the browser. The management UI is a public client (browser-based SPA) and should use the authorization code flow with PKCE (RFC 7636), which does not require a client secret.

If the oauth_client_secret configuration must be supported for backward compatibility, the rabbit_mgmt_oauth_bootstrap handler should require authentication before including it in the response.

References

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-522: Insufficiently Protected Credentials
• OAuth 2.0 Security Best Current Practice (RFC 6819) Section 5.3.5: Client secrets must be kept confidential
• OAuth 2.0 for Browser-Based Apps (RFC draft): Public clients should use PKCE instead of client secrets
• Commit tested: a155ee5