Описание
Admin path-traversal write via trace name
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_tracing/src/rabbit_tracing_consumer.erl:72 · Path Traversal
Impact
A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory.
Description
The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 — proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator.
Exploit scenario
Admin issues PUT /api/traces/%2F/..%2F..%2F..%2Fvar%2Flib%2Frabbitmq%2F.erlang.cookie. Broker opens /var/lib/rabbitmq/.erlang.cookie.log for writing. While the .log suffix limits direct cookie overwrite, the admin can write trace output (which includes attacker-published message bodies) to arbitrary .log paths.
Preconditions
- rabbitmq_tracing plugin enabled
- administrator tag
- Target path writable by rabbitmq OS user
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (2.1, Low). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1