Summary
RabbitMQ can allow LDAP injection when a configured user DN pattern directly substitutes a username without RFC 4514 escaping. A crafted username may alter the LDAP bind DN and select a different directory entry, although exploitation also requires a password valid for the resulting DN.
RabbitMQ can allow LDAP injection when a configured user DN pattern directly substitutes a username without RFC 4514 escaping. A crafted username may alter the LDAP bind DN and select a different directory entry, although exploitation also requires a password valid for the resulting DN.
Affected context
The issue affects RabbitMQ deployments using the LDAP authentication backend with a user_dn_pattern that contains the ${username} substitution. Risk depends on the directory structure, how usernames are accepted, and whether an injected DN suffix resolves to an account for which the attacker knows a valid password. The advisory reports affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines, with conflicting fixed-version metadata for some lines.
The issue affects RabbitMQ deployments using the LDAP authentication backend with a user_dn_pattern that contains the ${username} substitution. Risk depends on the directory structure, how usernames are accepted, and whether an injected DN suffix resolves to an account for which the attacker knows a valid password. The advisory reports affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines, with conflicting fixed-version metadata for some lines.
Exploit preconditions
- Attack surface: LDAP-backed user authentication through RabbitMQ
- Required access: Ability to submit or control a username during authentication
- Configuration requirement:
rabbitmq_auth_backend_ldapmust use auser_dn_patterncontaining${username} - Directory requirement: The directory layout must cause the altered DN to resolve to a useful entry
- Credential requirement: The attacker must possess a password valid for the resulting distinguished name
- Trigger point: Construction of the LDAP bind DN during authentication
- Why exploitation is possible: Username input is inserted into the DN without the required LDAP distinguished-name escaping
- Attack surface: LDAP-backed user authentication through RabbitMQ
- Required access: Ability to submit or control a username during authentication
- Configuration requirement:
rabbitmq_auth_backend_ldapmust use auser_dn_patterncontaining${username} - Directory requirement: The directory layout must cause the altered DN to resolve to a useful entry
- Credential requirement: The attacker must possess a password valid for the resulting distinguished name
- Trigger point: Construction of the LDAP bind DN during authentication
- Why exploitation is possible: Username input is inserted into the DN without the required LDAP distinguished-name escaping
Why this happens
The underlying bug is failure to apply RFC 4514 escaping when untrusted username data is embedded in an LDAP distinguished name. Special characters can change the structure or interpretation of the generated DN rather than remaining part of the username value. This is a form of CWE-90: Improper Neutralization of Special Elements used in an LDAP Query, because attacker-controlled input can alter an LDAP operation's intended target.
The underlying bug is failure to apply RFC 4514 escaping when untrusted username data is embedded in an LDAP distinguished name. Special characters can change the structure or interpretation of the generated DN rather than remaining part of the username value. This is a form of CWE-90: Improper Neutralization of Special Elements used in an LDAP Query, because attacker-controlled input can alter an LDAP operation's intended target.
Potential impact
- An attacker may authenticate as an unintended directory entry
- Authentication decisions could be influenced by LDAP DN manipulation
- Access to RabbitMQ resources may be granted under the wrong identity
- Authorization boundaries tied to directory groups or identities could be weakened
- Audit records may associate activity with an unexpected account
- An attacker may authenticate as an unintended directory entry
- Authentication decisions could be influenced by LDAP DN manipulation
- Access to RabbitMQ resources may be granted under the wrong identity
- Authorization boundaries tied to directory groups or identities could be weakened
- Audit records may associate activity with an unexpected account
General mitigation guidance
Mitigation generally focuses on treating usernames as untrusted data and preserving a strict separation between user attributes and LDAP syntax.
Common defensive patterns include:
- Apply standards-compliant DN escaping before incorporating usernames into distinguished names
- Prefer LDAP authentication designs that avoid constructing DNs from raw user input
- Use allowlisted username formats when operationally appropriate
- Enforce strict directory-side account and naming policies
- Apply least privilege to RabbitMQ users, LDAP service accounts, and directory access
- Avoid relying on ambiguous or user-controlled DN patterns for authorization decisions
- Resolve conflicting maintenance-line fix information through authoritative vendor or project release documentation before selecting a version
Mitigation generally focuses on treating usernames as untrusted data and preserving a strict separation between user attributes and LDAP syntax.
Common defensive patterns include:
- Apply standards-compliant DN escaping before incorporating usernames into distinguished names
- Prefer LDAP authentication designs that avoid constructing DNs from raw user input
- Use allowlisted username formats when operationally appropriate
- Enforce strict directory-side account and naming policies
- Apply least privilege to RabbitMQ users, LDAP service accounts, and directory access
- Avoid relying on ambiguous or user-controlled DN patterns for authorization decisions
- Resolve conflicting maintenance-line fix information through authoritative vendor or project release documentation before selecting a version
How teams detect issues like this
Detection can include static analysis and configuration review for direct interpolation of username values into LDAP DN templates, especially where escaping functions are absent. Code review should examine all LDAP bind construction paths, authentication callbacks, and configuration examples for raw ${username} substitution. Runtime monitoring can flag unusual usernames, unexpected bind DNs, authentication attempts containing DN metacharacters, and account or group mappings that differ from normal identity patterns. Policy enforcement may require approved LDAP templates, escaping utilities, and security tests covering special-character handling. Automated code and configuration review tools can help identify these patterns early.
Detection can include static analysis and configuration review for direct interpolation of username values into LDAP DN templates, especially where escaping functions are absent. Code review should examine all LDAP bind construction paths, authentication callbacks, and configuration examples for raw ${username} substitution. Runtime monitoring can flag unusual usernames, unexpected bind DNs, authentication attempts containing DN metacharacters, and account or group mappings that differ from normal identity patterns. Policy enforcement may require approved LDAP templates, escaping utilities, and security tests covering special-character handling. Automated code and configuration review tools can help identify these patterns early.
