Описание
Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11)
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbitmq_stream_management/priv/www/js/tmpl/streamConnection.ejs:102 · Stored XSS
Impact
Same as the connection.ejs finding, against operators viewing the stream-connection detail page.
Description
Lines 102/106/110 render peer_cert_subject / peer_cert_issuer with raw <%= %> and no fmt_string(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (\<img ... //\>). Requires non-default config: a stream TLS listener with verify_peer and an attacker-obtainable trusted cert with a malicious DN.
Exploit scenario
Attacker enrolls a cert with a <img onerror=...> CN from a CA the stream TLS listener trusts, connects on port 5551, and waits for an operator to open the stream-connection detail page.
Preconditions
- rabbitmq_stream + rabbitmq_stream_management enabled with a TLS listener using
verify_peer - Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN
- An operator views the stream-connection detail page
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (7.6, High). Fixed in 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.18
3.13.18
rabbitmq
>= 4.0.0, < 4.0.23
4.0.23
rabbitmq
>= 4.1.0, < 4.1.14
4.1.14
rabbitmq
>= 4.2.0, < 4.2.9
4.2.9
rabbitmq
>= 4.3.0, < 4.3.3
4.3.3
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.
RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.1 ...