Описание
Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
Impact
An obsolete HTTP API endpoint, GET /api/auth, revealed client secret (as in OAuth 2) on RabbitMQ installations that had OAuth 2 configured to use the management.oauth_client_secret configuration key.
RabbitMQ installations that do not use OAuth 2 or used OAuth 2 with a different configuration and grant type(s) are not affected. Installations where the management plugin is not enabled (e.g. Prometheus and Grafana, CLI tools are used instead) are not affected.
Patches
The endpoint in question was a leftover from earlier generations of the OAuth 2 plugin and was removed.
See the Affected Versions table above for the list of patched versions.
Workarounds
One or several of:
- Disable the
rabbitmq_auth_backend_oauth2plugin and switch to a different backend - Switch to a different grant type (avoid using
management.oauth_client_secret) - Use Prometheus and Grafana for monitoring, disable the
rabbitmq_managementplugin
Пакеты
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20 ...