Описание
Atom exhaustion: to_atom on global-parameter :name
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_management/src/rabbit_mgmt_wm_global_parameter.erl:71 · Atom Table Exhaustion
Impact
A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name values.
Description
resource_exists/2 (and the PUT/DELETE handlers) call rabbit_data_coercion:to_atom/1 on the :name URL path segment. to_atom/1 uses binary_to_atom/2 (unsafe). The endpoint requires policymaker (not management, but below administrator).
Exploit scenario
for i in $(seq 1 1000000); do curl -u policymaker:pw broker:15672/api/global-parameters/gp-$i; done. Each GET creates atom 'gp-$i' in resource_exists. VM aborts at ~1M.
Preconditions
- Management plugin enabled
- policymaker tag
- ~1M HTTP requests
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (5.9, Moderate). Fixed in 4.0.22, 4.1.14, 4.2.7, 4.3.1.
Пакеты
rabbitmq
>= 4.0.0, < 4.0.22
4.0.22
rabbitmq
>= 4.1.0, < 4.1.14
4.1.14
rabbitmq
>= 4.2.0, < 4.2.7
4.2.7
rabbitmq
>= 4.3.0, < 4.3.1
4.3.1