Описание
Stream protocol skips per vhost per user connection limits
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_stream/src/rabbit_stream_reader.erl:1515 · Access-control gap
Impact
An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672.
Description
The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream.
Exploit scenario
Operator sets rabbitmqctl set_user_limits tenant '{"max-connections":10}'. Tenant opens 1000 stream connections on port 5552; all succeed, exhausting file descriptors / scheduler capacity for other tenants.
Preconditions
- rabbitmq_stream plugin enabled
- Authenticated stream-protocol credentials
- Operator relies on per-user/per-vhost connection limits for tenant isolation
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.0, Moderate). Fixed in 4.2.7, 4.3.1.
Пакеты
rabbitmq
>= 4.2.0, < 4.2.7
4.2.7
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1