Описание
protected tag bypass via bulk-delete
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_management/src/rabbit_mgmt_wm_users_bulk_delete.erl:40 · Access-control bypass
Impact
An administrator can delete protected-tagged service accounts via the bulk endpoint, bypassing a safeguard the test suite confirms is intentional.
Description
DELETE /api/users/:name refuses to delete users tagged protected (rabbit_mgmt_wm_user:delete_resource/2 checks is_protected_user). POST /api/users/bulk-delete iterates the supplied username list and calls rabbit_auth_backend_internal:delete_user/2 directly — that function has no protected-tag check — so the guard is silently bypassed.
Exploit scenario
An admin (or compromised admin session, e.g. via the XSS findings above) sends POST /api/users/bulk-delete {"users":["rmq-internal"]}; the protected service account is deleted, breaking dependent integrations and removing the guard that was supposed to prevent exactly this.
Preconditions
- rabbitmq_management enabled
- Attacker has the
administratortag - A
protected-tagged user exists
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (2.1, Low). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6