Описание
Monitoring-tag DELETE of auth-attempt metrics
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_management/src/rabbit_mgmt_wm_auth_attempts.erl:35 · Broken Access Control
Impact
A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator.
Description
is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation.
Exploit scenario
After a credential-stuffing attempt, attacker (with stolen monitoring creds) issues DELETE /api/auth/attempts/rabbit@node1 to zero the failure counters before the security team's dashboard polls.
Preconditions
- Management plugin enabled
- monitoring tag
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (2.3, Low). Fixed in 4.1.13, 4.2.7, 4.3.0.
Пакеты
rabbitmq
>= 4.1.0, < 4.1.13
4.1.13
rabbitmq
>= 4.2.0, < 4.2.7
4.2.7