GHSA-qxrp-7cmp-p77h

Описание

Overview

The rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, which results in JavaScript execution in the browser.

This issue appears to be in the same family as CVE-2021-32719 and was still reproducible in the current repository checkout.

• Vulnerability type: Stored XSS
• Affected component: rabbitmq_federation_management
• Verification date: 2026-03-11

Impact

If a user who can configure a federation upstream or policy stores a malicious consumer-tag, any administrator or monitoring user who opens the Federation Status page can trigger arbitrary JavaScript execution in their browser.

This enables session theft, CSRF chaining under an administrator session, and arbitrary actions through the management UI.

Root Cause Summary

The issue is caused by the following chain:

1. consumer-tag input accepts arbitrary binary data
2. The value is exposed unchanged in federation status responses
3. The management UI template renders the value without HTML escaping

Relevant code locations:

• Input validation: rabbit_federation_parameters.erl
• Status serialization: rabbit_federation_status.erl
• Vulnerable rendering sink: federation.ejs
• EJS <%= handling: ejs-1.0.js

Detailed Analysis

1. Input acceptance

consumer-tag is validated only as a binary value.

That means HTML tags and event handlers are not rejected.

2. Propagation into federation status

When a queue federation link is serialized into JSON, consumer_tag is included as-is.

3. Unsafe management UI rendering

The Federation Status template renders consumer_tag directly.

By contrast, the related federation-upstreams.ejs template uses fmt_string(...), so this page is inconsistent with the safer rendering pattern used elsewhere in the same plugin.

In addition, the bundled legacy EJS engine does not HTML-escape <%= output. It only converts the value to text.

As a result, a value such as <img src=x onerror=alert(1)> is inserted into the DOM as raw HTML.

Dynamic Reproduction Environment

The issue was reproduced locally under the following conditions:

• rabbitmq_management, rabbitmq_federation, and rabbitmq_federation_management were enabled
• A localhost proxy container was used so the UI was reachable at http://localhost:15672
• A test UI account xss / xss was created

Containers used during reproduction:

• rabbitmq-dev: actual broker
• rabbitmq-localhost: localhost:15672 proxy

Reproduction Steps

1. Create a malicious federation upstream

The upstream was created with an XSS payload in consumer-tag.

2. Create a queue federation policy

3. Prepare the upstream and downstream queues

• Upstream queue: srcxss.q
• Downstream queue: fedlive.q
• A consumer was attached to the downstream queue so that the queue federation link actually started

Important detail:

Queue federation did not start merely from the policy being present. A live consumer was required before the link transitioned to running. This matched the behavior in rabbit_federation_queue.erl and rabbit_federation_queue_link.erl.

4. Confirm the payload in the API

The payload was present unchanged in the federation API response.

Observed response excerpt:

5. Confirm browser-side execution

The issue was then confirmed in the management UI:

• URL: http://localhost:15672/
• Account: xss / xss
• Page: http://localhost:15672/#/federation

When the running row for fedlive.q was rendered, the alert executed in the browser.

Reproduction Results

CLI evidence

Observed output excerpt:

Template rendering evidence

Rendering the template directly through the same EJS engine produced the following HTML:

This shows that the issue is not just reflected text in an API response. It is a real DOM-inserted XSS sink.

Notes

The payload also remained visible in API and CLI output for error state links. However, federation.ejs does not render the consumer_tag cell on the link.error branch.

For that reason, the most accurate browser execution proof used a running federation link.

Recommended Fix

The smallest fix is to escape consumer_tag in the Federation Status template.

Current code:

Recommended change:

The following regression tests should also be added:

• Verify that a federation link with HTML in consumer-tag is displayed as escaped text in the UI
• Verify that both running and error rows are rendered safely

Conclusion

The Federation Management XSS is reproducible in the current rabbitmq-server source checkout.

• The input is accepted
• The payload is preserved in federation status output
• The management UI renders it as raw HTML
• Actual browser-side JavaScript execution was confirmed