Описание
Node can log Basic Auth header from an HTTP request
Summary
RabbitMQ seems to be logging authorization header in plaintext (encoded in base64) when error arises, e.g. non-existent queue
Details
When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers - Showing base64 encoded username:password - which is easy to decode and afterwards used to obtain control to the system (depending on the type of credentials).
Found on
- OS: Windows
- RabbitMQ 3.13.7 and 3.13.2
- Erlang 26.2.5
PoC
- Created new admin user "tmp" with pwd "tmp" via rabbitmq management console:
-
Created a GET request in pwsh using basic authentication to non-existent queue
-
Executed pwsh script PoCRabbitMQ.txt
- Checked the logs of RabbitMQ and found the error logs with the authorization headers:
Impact
Information Disclosure of credentials of users whose actions may raise an error - like searching queue that does not exist.
Пакеты
rabbitmq
>= 4.0.0, < 4.0.8
4.0.8
rabbitmq
>= 3.13.0, < 3.13.8
3.13.8
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and p ...