Описание
OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl:214 · Authentication Bypass (Token Expiry)
Impact
If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped — an already-expired token is accepted, and connections never time out. Attacker has zero control over the trigger (it's sealed by the IdP's signature).
Description
validate_token_expiry/1 (lines 208-214) and expiry_timestamp/1 (138-144) both guard with 'when is_integer(Exp)' and fall through to ok/never for float values. jose_jwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the path.
Exploit scenario
IdP emits "exp": 1700000300.0. Token expires at IdP. Weeks later, attacker (who saved the token) presents it; validate_token_expiry returns ok; broker authenticates; connection has no disconnect timer.
Preconditions
- OAuth2 backend enabled
- IdP emits float exp (uncommon; mainstream IdPs emit integers)
- Attacker possesses a previously-valid signed token
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (6.3, Moderate). Fixed in 4.2.9, 4.3.3.
Пакеты
rabbitmq
>= 4.2.0, < 4.2.9
4.2.9
rabbitmq
>= 4.3.0, < 4.3.3
4.3.3