Описание
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
A flaw was found in rabbitmq-server. When the Open Authorization (OAuth) management interface is enabled, error messages fail to properly sanitize queue names and render them as raw HTML. An authenticated attacker with queue configuration permissions can create a queue name containing malicious HTML elements that redirect automatic page refreshes to an external server when an administrator interacts with the queue. This flaw can result in information disclosure, allowing the attacker to intercept the administrator's authorization credentials.
Отчет
This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires multiple prerequisites, including existing authenticated queue-creation privileges, an environment using OAuth for management authentication, and specific user interaction from an administrator viewing the queue. In typical Red Hat OpenStack Platform and container environments, OAuth integration for the RabbitMQ web console is not enabled by default, significantly reducing out-of-the-box exposure. Even when OAuth is configured, an attacker must possess legitimate queue definition rights and entice a privileged operator to inspect the crafted queue within the management console to capture credentials.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | rabbitmq-server4.2 | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 16.2 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 17.1 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 18.0 | rabbitmq-server | Fix deferred | ||
| Red Hat Hardened Images | rabbitmq-server4-3-main-4.3.6-1.hum1 | Fixed | RHSA-2026:67552 | 15.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.1 ...
EPSS
4.4 Medium
CVSS3