Описание
Unsanitized vhost names allow for XSS in management UI
Summary
Unsanitized virtual host names allow for XSS in the the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart.
Details
The relevant blocks were introduced in https://github.com/rabbitmq/rabbitmq-server/commit/7f54319279d1ece161ae0b4cdc6f0e58a4045eb5. In vhost.ejs and vhosts.ejs the forms to restart a dead vhost include a hidden input with the vhost name without using the fmt_string sanitizer. Wrapping these values in fmt_string fixes this issue without affecting the form's functionality.
Impact
Since vhost names are not limited in length (to my knowledge), the XSS script can be arbitrarily long. It requires the ability to create vhosts as well as a means to kill them somehow, and for the attack to affect unsuspecting users they need to visit the vhost page of the malicious vhost.
Пакеты
rabbitmq
>= 4.1.0, < 4.1.2
4.1.2
rabbitmq
>= 4.0.0, < 4.0.13
4.0.13
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.
RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.
RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.
RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1 ...