Summary
RabbitMQ Management UI can expose an OAuth2 client secret through an unauthenticated JavaScript endpoint when OAuth2 authentication is enabled and the identity provider configuration uses a client secret. Anyone who can reach the management UI port may retrieve the secret, which could enable client impersonation or abuse of OAuth2 authorization flows.
RabbitMQ Management UI can expose an OAuth2 client secret through an unauthenticated JavaScript endpoint when OAuth2 authentication is enabled and the identity provider configuration uses a client secret. Anyone who can reach the management UI port may retrieve the secret, which could enable client impersonation or abuse of OAuth2 authorization flows.
Affected context
The issue occurs in RabbitMQ deployments where:
- The Management UI is enabled and reachable
- OAuth2 authentication is configured for the UI
- The selected identity-provider flow uses a client secret
- The OAuth2 bootstrap JavaScript endpoint is accessible without authentication
In this configuration, the secret may be embedded in JavaScript served by /js/oidc-oauth/bootstrap.js.
The issue occurs in RabbitMQ deployments where:
- The Management UI is enabled and reachable
- OAuth2 authentication is configured for the UI
- The selected identity-provider flow uses a client secret
- The OAuth2 bootstrap JavaScript endpoint is accessible without authentication
In this configuration, the secret may be embedded in JavaScript served by /js/oidc-oauth/bootstrap.js.
Exploit preconditions
- Attack surface: RabbitMQ Management UI HTTP endpoint
- Required access: Network reachability to the Management UI port; authentication to RabbitMQ is not required for the affected endpoint
- Trigger point: Requesting the unauthenticated OAuth2 bootstrap JavaScript resource
- Why exploitation is possible: Sensitive OAuth2 configuration data is included in a response intended for unauthenticated clients
- Attack surface: RabbitMQ Management UI HTTP endpoint
- Required access: Network reachability to the Management UI port; authentication to RabbitMQ is not required for the affected endpoint
- Trigger point: Requesting the unauthenticated OAuth2 bootstrap JavaScript resource
- Why exploitation is possible: Sensitive OAuth2 configuration data is included in a response intended for unauthenticated clients
Why this happens
The vulnerability results from exposing a confidential OAuth2 client configuration value through an unauthenticated web response. The Management UI route serves bootstrap JavaScript containing the configured client secret instead of limiting the response to non-sensitive public configuration.
This maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, because a credential is disclosed to users who have not been authenticated or authorized to receive it.
The vulnerability results from exposing a confidential OAuth2 client configuration value through an unauthenticated web response. The Management UI route serves bootstrap JavaScript containing the configured client secret instead of limiting the response to non-sensitive public configuration.
This maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, because a credential is disclosed to users who have not been authenticated or authorized to receive it.
Potential impact
- An attacker may obtain the OAuth2 client secret
- The secret could enable client impersonation against the identity provider
- Attackers could potentially abuse authorization-code flows or related tokens
- Unauthorized requests may be made using the compromised client identity
- Downstream RabbitMQ or identity-provider access could be affected, depending on permissions
- An attacker may obtain the OAuth2 client secret
- The secret could enable client impersonation against the identity provider
- Attackers could potentially abuse authorization-code flows or related tokens
- Unauthorized requests may be made using the compromised client identity
- Downstream RabbitMQ or identity-provider access could be affected, depending on permissions
General mitigation guidance
Mitigation focuses on ensuring that client secrets never cross an unauthenticated browser boundary.
Common defensive patterns include:
- Keeping OAuth2 client secrets exclusively in server-side or protected secret stores
- Serving only public OAuth2 client metadata to browser-based components
- Reviewing unauthenticated routes for credentials, tokens, and sensitive configuration values
- Applying authentication and authorization controls to configuration-bearing endpoints
- Using least-privilege scopes and permissions for OAuth2 clients
- Rotating exposed client credentials and reviewing identity-provider and broker logs when disclosure is suspected
Mitigation focuses on ensuring that client secrets never cross an unauthenticated browser boundary.
Common defensive patterns include:
- Keeping OAuth2 client secrets exclusively in server-side or protected secret stores
- Serving only public OAuth2 client metadata to browser-based components
- Reviewing unauthenticated routes for credentials, tokens, and sensitive configuration values
- Applying authentication and authorization controls to configuration-bearing endpoints
- Using least-privilege scopes and permissions for OAuth2 clients
- Rotating exposed client credentials and reviewing identity-provider and broker logs when disclosure is suspected
How teams detect issues like this
Organizations can detect this class of issue through:
- Dynamic testing of unauthenticated Management UI routes for secret-like values
- Static analysis and code review checks for credentials interpolated into JavaScript responses
- Route inventory reviews that compare authentication requirements with response sensitivity
- Secret-scanning policies applied to generated web assets and HTTP fixtures
- Monitoring for unusual OAuth2 authorization activity or client use from unexpected sources
Automated security review tools may help identify hard-coded or response-bound credential exposure, but findings should be validated against deployment configuration.
Organizations can detect this class of issue through:
- Dynamic testing of unauthenticated Management UI routes for secret-like values
- Static analysis and code review checks for credentials interpolated into JavaScript responses
- Route inventory reviews that compare authentication requirements with response sensitivity
- Secret-scanning policies applied to generated web assets and HTTP fixtures
- Monitoring for unusual OAuth2 authorization activity or client use from unexpected sources
Automated security review tools may help identify hard-coded or response-bound credential exposure, but findings should be validated against deployment configuration.
