Описание
Monitoring-tag user can restart federation links
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_federation_management/src/rabbit_federation_mgmt.erl:64 · Broken access control
Impact
A read-only monitoring user can restart any federation link — a state-changing operation that disrupts message flow.
Description
is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional.
Exploit scenario
User with only the monitoring tag runs curl -u mon:pw -X DELETE http://broker:15672/api/federation-links/%2F/...; the federation link restarts, briefly interrupting cross-cluster message flow.
Preconditions
- rabbitmq_federation + rabbitmq_federation_management plugins enabled
- Attacker has credentials with the
monitoringtag
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (2.3, Low). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1