Summary
RabbitMQ's Shovel management resource may allow users with the monitoring tag to delete or restart shovel runtime parameters, despite that role being intended for read-only visibility. The issue becomes risky when the Shovel and Shovel Management plugins are enabled and a monitoring user can view affected shovels.
RabbitMQ's Shovel management resource may allow users with the monitoring tag to delete or restart shovel runtime parameters, despite that role being intended for read-only visibility. The issue becomes risky when the Shovel and Shovel Management plugins are enabled and a monitoring user can view affected shovels.
Affected context
The vulnerability occurs in RabbitMQ deployments that enable the rabbitmq_shovel and rabbitmq_shovel_management plugins. It affects management operations for dynamic shovels when authorization is based only on the monitoring tag, allowing a role intended for observation to reach deletion or restart behavior without an additional policymaker-level check.
The vulnerability occurs in RabbitMQ deployments that enable the rabbitmq_shovel and rabbitmq_shovel_management plugins. It affects management operations for dynamic shovels when authorization is based only on the monitoring tag, allowing a role intended for observation to reach deletion or restart behavior without an additional policymaker-level check.
Exploit preconditions
- Attack surface: RabbitMQ Shovel management resource
- Required access: Valid RabbitMQ credentials associated with the monitoring tag
- Required deployment state: The rabbitmq_shovel and rabbitmq_shovel_management plugins are enabled
- Visibility requirement: The account can see the target shovel and its virtual host
- Trigger point: A management request invoking shovel deletion or restart behavior
- Why exploitation is possible: The authorization path accepts the monitoring role, while the state-changing operation does not perform an equivalent higher-privilege role check
- Attack surface: RabbitMQ Shovel management resource
- Required access: Valid RabbitMQ credentials associated with the monitoring tag
- Required deployment state: The rabbitmq_shovel and rabbitmq_shovel_management plugins are enabled
- Visibility requirement: The account can see the target shovel and its virtual host
- Trigger point: A management request invoking shovel deletion or restart behavior
- Why exploitation is possible: The authorization path accepts the monitoring role, while the state-changing operation does not perform an equivalent higher-privilege role check
Why this happens
The underlying defect is an authorization mismatch between the role permitted to access a management resource and the privileges required for its operations. The resource delegates authorization to a check that accepts the monitoring tag, while its allowed state-changing methods lack an additional policymaker-level authorization check. This maps to CWE-862, Missing Authorization, because a sensitive operation is reachable without enforcing the authorization boundary intended for that operation.
The underlying defect is an authorization mismatch between the role permitted to access a management resource and the privileges required for its operations. The resource delegates authorization to a check that accepts the monitoring tag, while its allowed state-changing methods lack an additional policymaker-level authorization check. This maps to CWE-862, Missing Authorization, because a sensitive operation is reachable without enforcing the authorization boundary intended for that operation.
Potential impact
- A monitoring user may delete dynamic shovels they can view
- A monitoring user may restart shovel runtime parameters
- Message routing or replication may be disrupted
- Applications may experience availability or delivery failures
- Unauthorized changes may affect data movement and operational integrity
- A monitoring user may delete dynamic shovels they can view
- A monitoring user may restart shovel runtime parameters
- Message routing or replication may be disrupted
- Applications may experience availability or delivery failures
- Unauthorized changes may affect data movement and operational integrity
General mitigation guidance
Mitigation generally focuses on enforcing operation-specific authorization
rather than relying solely on resource visibility or broad role checks.
Common defensive patterns include:
- Require a role with explicit permission for every shovel mutation, including deletion and restart operations
- Keep monitoring permissions read-only by default
- Apply least privilege to RabbitMQ users, virtual hosts, and management interfaces
- Separate observation endpoints from state-changing management actions
- Restrict access to management plugins through network policy and administrative access controls
- Review plugin configuration and disable unused Shovel management functionality where appropriate
- Log and alert on shovel lifecycle changes, especially when initiated by monitoring accounts
Mitigation generally focuses on enforcing operation-specific authorization
rather than relying solely on resource visibility or broad role checks.
Common defensive patterns include:
- Require a role with explicit permission for every shovel mutation, including deletion and restart operations
- Keep monitoring permissions read-only by default
- Apply least privilege to RabbitMQ users, virtual hosts, and management interfaces
- Separate observation endpoints from state-changing management actions
- Restrict access to management plugins through network policy and administrative access controls
- Review plugin configuration and disable unused Shovel management functionality where appropriate
- Log and alert on shovel lifecycle changes, especially when initiated by monitoring accounts
How teams detect issues like this
Organizations can identify this class of issue through:
- Authorization tests that verify monitoring users cannot invoke destructive or state-changing management methods
- Code review checks comparing allowed HTTP methods with operation-specific role enforcement
- Static analysis searches for management handlers that perform mutations without a corresponding authorization guard
- Policy tests covering every RabbitMQ role against shovel creation, deletion, restart, and configuration operations
- Audit-log analysis for shovel changes performed by accounts with monitoring-only roles
- Automated security review tools that flag inconsistent authorization checks across related API endpoints
Organizations can identify this class of issue through:
- Authorization tests that verify monitoring users cannot invoke destructive or state-changing management methods
- Code review checks comparing allowed HTTP methods with operation-specific role enforcement
- Static analysis searches for management handlers that perform mutations without a corresponding authorization guard
- Policy tests covering every RabbitMQ role against shovel creation, deletion, restart, and configuration operations
- Audit-log analysis for shovel changes performed by accounts with monitoring-only roles
- Automated security review tools that flag inconsistent authorization checks across related API endpoints
