GHSA-q44f-9vc5-grh7

Описание

Summary

The shovel worker gen_server processes does not implement the format_status/2 callback. When these processes crash (e.g., due to network partitions, connection failures), the OTP SASL error handler writes the full process state — including plaintext AMQP passwords and URIs — to the error log.

This is particularly severe for the shovel worker, which stores deobfuscated plaintext URIs (including amqp://user:password@host format) in its gen_server state for the entire process lifetime.

Affected Modules

rabbit_shovel_worker

The shovel worker stores deobfuscated URIs in its #state.config map:

These plaintext URIs (containing passwords in amqp://user:PASSWORD@host/vhost format) are stored under source => #{uris => SrcURIs} and dest => #{uris => DestURIs} in the config map, which is part of the gen_server state.

The same pattern exists in rabbit_amqp10_shovel.erl at lines 107 and 126.

Missing Callback

Confirmed: grep -rn format_status across the shovel source code returns zero results. None of these gen_server modules implement format_status/2 (OTP < 25) or format_status/1 (OTP 25+).

Exposure Paths

Path 1: SASL Error Reports (Always Enabled)

When a shovel worker crashes (e.g., network partition, connection timeout), OTP writes:

SASL error reports are written at ERROR level, which is always enabled in production — no DEBUG logging required.

Path 2: Erlang Crash Dumps

Full BEAM crash dumps (written on VM crash) include all process states, exposing credentials for every active shovel.

Impact

• Automatic Credential Exposure: Shovel worker crashes (common during network partitions) automatically write plaintext upstream/downstream passwords to error logs
• No Special Configuration Needed: Unlike DEBUG logging, SASL error reports are always active
• Broad Exposure Surface: Crash dumps are routinely collected during production incidents and shared with support teams, centralized logging systems, and monitoring platforms
• Multiple Credential Sets: Each shovel can expose a separate set of credentials, potentially revealing passwords for many upstream/downstream brokers

Suggested Fix

Implement format_status/1 (OTP 25+) in each affected module to redact credentials: