GHSA-rg2g-289m-xhhw

Описание

Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Source references

deps/rabbit/src/rabbit_amqp_management.erl:192 · Authorization bypass

Impact

A user with only configure on exchange X can route X's unroutable messages into an alternate exchange they have no write permission on.

Description

PUT /exchanges/:name (lines 192-240) checks only configure on the declared exchange and passes XArgs straight to rabbit_exchange:declare/7. It omits the check_read_permitted(X) + check_write_permitted(AE) that rabbit_channel.erl:2540-2548 enforces for the alternate-exchange argument on the AMQP 0-9-1 path. The same file already implements the analogous DLX check for queues (lines 708-719), confirming this is a missing-check bug rather than intentional design.

Exploit scenario

User has configure on tenant.x but no write on audit.x. Via AMQP 1.0 HTTP-over-AMQP management, they declare tenant.x with argument alternate-exchange=audit.x. Unroutable messages published to tenant.x are now silently delivered into audit.x, which the user could not otherwise write to.

Preconditions

• AMQP 1.0 enabled (default in RabbitMQ 4.x)
• Attacker has configure on at least one exchange but lacks write on the target alternate-exchange

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N (4.8, Moderate). Fixed in 4.3.3.