Summary
RabbitMQ can place attacker-controlled bearer-token content from an Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping it. When OAuth is enabled and a user loads the affected management endpoint, the injected content may execute JavaScript in the RabbitMQ management UI origin.
RabbitMQ can place attacker-controlled bearer-token content from an Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping it. When OAuth is enabled and a user loads the affected management endpoint, the injected content may execute JavaScript in the RabbitMQ management UI origin.
Affected context
The vulnerability affects RabbitMQ deployments using the management plugin with OAuth authentication enabled and an affected 4.2.x or 4.3.x release. The risk arises when token content is incorporated into client-side bootstrap JavaScript without context-appropriate escaping. Exploitation through the cookie path also depends on an attacker being able to plant an access_token cookie for the management host.
The vulnerability affects RabbitMQ deployments using the management plugin with OAuth authentication enabled and an affected 4.2.x or 4.3.x release. The risk arises when token content is incorporated into client-side bootstrap JavaScript without context-appropriate escaping. Exploitation through the cookie path also depends on an attacker being able to plant an access_token cookie for the management host.
Exploit preconditions
- Attack surface: RabbitMQ management UI OAuth bootstrap endpoint
- Required access: Ability to influence the Authorization header or, for the cookie path, plant an access_token cookie on the management host
- Trigger point: A user or browser loads the OAuth-enabled management endpoint
- Why exploitation is possible: Token data is embedded into JavaScript without escaping, allowing crafted content to cross from data into executable script
- Attack surface: RabbitMQ management UI OAuth bootstrap endpoint
- Required access: Ability to influence the Authorization header or, for the cookie path, plant an access_token cookie on the management host
- Trigger point: A user or browser loads the OAuth-enabled management endpoint
- Why exploitation is possible: Token data is embedded into JavaScript without escaping, allowing crafted content to cross from data into executable script
Why this happens
The underlying bug is a failure to apply context-aware output encoding when inserting authentication token data into JavaScript source. Because attacker-influenced values are treated as trusted script content, specially crafted token text can alter the generated bootstrap code and execute in the management UI origin. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
The underlying bug is a failure to apply context-aware output encoding when inserting authentication token data into JavaScript source. Because attacker-influenced values are treated as trusted script content, specially crafted token text can alter the generated bootstrap code and execute in the management UI origin. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
Potential impact
- An attacker may execute arbitrary JavaScript in a victim's management UI session.
- Malicious script could access data available to the management origin.
- An attacker could perform management actions in the victim's browser context, subject to that user's permissions.
- The issue could facilitate credential, session, or operational-data theft.
- Compromise could contribute to messaging configuration changes or broader broker abuse.
- An attacker may execute arbitrary JavaScript in a victim's management UI session.
- Malicious script could access data available to the management origin.
- An attacker could perform management actions in the victim's browser context, subject to that user's permissions.
- The issue could facilitate credential, session, or operational-data theft.
- Compromise could contribute to messaging configuration changes or broader broker abuse.
General mitigation guidance
Mitigation focuses on preventing attacker-controlled token data from becoming executable browser content.
Common defensive patterns include:
- Apply context-aware JavaScript string encoding or use safe structured-data serialization when generating bootstrap data.
- Prefer APIs that pass configuration as inert data rather than concatenating values into executable script.
- Validate token formats and reject unexpected characters where appropriate, without relying on validation as a substitute for output encoding.
- Use restrictive Content Security Policy controls as defense in depth.
- Limit management UI privileges and avoid granting users more broker permissions than necessary.
- Restrict who can set cookies or influence authentication headers for management hosts.
Mitigation focuses on preventing attacker-controlled token data from becoming executable browser content.
Common defensive patterns include:
- Apply context-aware JavaScript string encoding or use safe structured-data serialization when generating bootstrap data.
- Prefer APIs that pass configuration as inert data rather than concatenating values into executable script.
- Validate token formats and reject unexpected characters where appropriate, without relying on validation as a substitute for output encoding.
- Use restrictive Content Security Policy controls as defense in depth.
- Limit management UI privileges and avoid granting users more broker permissions than necessary.
- Restrict who can set cookies or influence authentication headers for management hosts.
How teams detect issues like this
Organizations can look for:
- Static-analysis findings where HTTP headers or cookies are concatenated into JavaScript, HTML, or script templates.
- Code-review signals involving authentication values inserted into inline scripts without context-specific encoding.
- Tests that supply metacharacters through Authorization headers and cookies and verify that responses contain inert, correctly encoded data.
- Web-application monitoring for unexpected script content or unusual requests to OAuth bootstrap endpoints.
- Policy enforcement requiring safe serialization libraries, output-encoding utilities, and security tests for management interfaces.
Automated code-review and SAST tools may help identify these data-flow patterns.
Organizations can look for:
- Static-analysis findings where HTTP headers or cookies are concatenated into JavaScript, HTML, or script templates.
- Code-review signals involving authentication values inserted into inline scripts without context-specific encoding.
- Tests that supply metacharacters through Authorization headers and cookies and verify that responses contain inert, correctly encoded data.
- Web-application monitoring for unexpected script content or unusual requests to OAuth bootstrap endpoints.
- Policy enforcement requiring safe serialization libraries, output-encoding utilities, and security tests for management interfaces.
Automated code-review and SAST tools may help identify these data-flow patterns.
