Описание
Cross-vhost quorum-queue status and stream tracking disclosure
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_status.erl:65 · Missing Authorization (IDOR)
Impact
Any management-tagged user can read Raft status (leader, members, term, commit index) for quorum queues in vhosts they have no access to, leaking cross-tenant queue names and cluster topology.
Description
is_authorized/2 calls plain rabbit_mgmt_util:is_authorized/2 (tag check only) instead of is_authorized_vhost/2. The route is /api/queues/quorum/:vhost/:queue/status; the handler reads :vhost from the path but never checks the user has access to it.
Exploit scenario
User tenant-a (management tag, access only to vhost tenant-a) requests GET /api/queues/quorum/tenant-b/orders/status and receives {"leader":"rabbit@node2","members":[...],"term":47}.
Preconditions
- Management plugin enabled
- management tag
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (2.3, Low). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6