Summary
A missing authorization check in RabbitMQ Federation can allow a policymaker on one virtual host to read and drain messages from another virtual host without permission. When the default acknowledgment mode is used, affected source messages may be consumed and deleted rather than copied, creating a cross-tenant data access risk.
A missing authorization check in RabbitMQ Federation can allow a policymaker on one virtual host to read and drain messages from another virtual host without permission. When the default acknowledgment mode is used, affected source messages may be consumed and deleted rather than copied, creating a cross-tenant data access risk.
Affected context
The issue occurs in RabbitMQ deployments using Federation upstreams across multiple virtual hosts. It becomes risky when a user can configure or influence federation policy on one virtual host, while the federation configuration can target an upstream associated with another virtual host without confirming access to that destination. The impact is most significant where virtual hosts are intended to provide tenant or application isolation.
The issue occurs in RabbitMQ deployments using Federation upstreams across multiple virtual hosts. It becomes risky when a user can configure or influence federation policy on one virtual host, while the federation configuration can target an upstream associated with another virtual host without confirming access to that destination. The impact is most significant where virtual hosts are intended to provide tenant or application isolation.
Exploit preconditions
- Attack surface: RabbitMQ Federation configuration and upstream-policy handling
- Required access: Authenticated access sufficient to create or modify federation policy on a virtual host
- Trigger point: Federation establishes or consumes from an upstream configured for another virtual host
- Why exploitation is possible: The upstream URI is validated without enforcing the requesting policymaker's authorization to the referenced virtual host
- Attack surface: RabbitMQ Federation configuration and upstream-policy handling
- Required access: Authenticated access sufficient to create or modify federation policy on a virtual host
- Trigger point: Federation establishes or consumes from an upstream configured for another virtual host
- Why exploitation is possible: The upstream URI is validated without enforcing the requesting policymaker's authorization to the referenced virtual host
Why this happens
The underlying flaw is an authorization gap in Federation upstream validation. RabbitMQ permits a federation relationship to be configured without applying the relevant virtual-host access check, allowing a policymaker's authority in one vhost to influence message consumption in another. This maps to CWE-862: Missing Authorization, because access control is not consistently enforced at the resource boundary where messages are read.
The underlying flaw is an authorization gap in Federation upstream validation. RabbitMQ permits a federation relationship to be configured without applying the relevant virtual-host access check, allowing a policymaker's authority in one vhost to influence message consumption in another. This maps to CWE-862: Missing Authorization, because access control is not consistently enforced at the resource boundary where messages are read.
Potential impact
- Unauthorized users may read messages from another virtual host
- Source messages may be drained and deleted under the default acknowledgment behavior
- Tenant or application isolation may be weakened
- Confidential business or operational data could be disclosed
- Downstream consumers may experience message loss or processing disruption
- Unauthorized users may read messages from another virtual host
- Source messages may be drained and deleted under the default acknowledgment behavior
- Tenant or application isolation may be weakened
- Confidential business or operational data could be disclosed
- Downstream consumers may experience message loss or processing disruption
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every Federation resource boundary and preserving virtual-host isolation.
Common defensive patterns include:
- Require explicit access to the target virtual host before accepting or activating an upstream
- Apply authorization checks when federation policies, upstreams, and message-consumption paths are evaluated
- Limit policy-management privileges to trusted administrators and separate them by tenant or environment
- Use distinct credentials and narrowly scoped permissions for federation connections
- Prefer secure acknowledgment and replay policies appropriate to the application's loss-tolerance requirements
- Monitor and review cross-vhost federation relationships as part of configuration governance
Mitigation generally focuses on enforcing authorization at every Federation resource boundary and preserving virtual-host isolation.
Common defensive patterns include:
- Require explicit access to the target virtual host before accepting or activating an upstream
- Apply authorization checks when federation policies, upstreams, and message-consumption paths are evaluated
- Limit policy-management privileges to trusted administrators and separate them by tenant or environment
- Use distinct credentials and narrowly scoped permissions for federation connections
- Prefer secure acknowledgment and replay policies appropriate to the application's loss-tolerance requirements
- Monitor and review cross-vhost federation relationships as part of configuration governance
How teams detect issues like this
Organizations can look for this issue through:
- Access-control tests verifying that a policymaker cannot configure or consume from unauthorized virtual hosts
- Code review checks for federation paths that validate URI syntax without validating vhost permissions
- Static analysis and policy rules requiring authorization checks before cross-tenant resource access
- Auditing federation policy changes, upstream definitions, and unusual message-drain activity
- Regression tests covering denied cross-vhost access and default acknowledgment behavior
Automated code review and configuration-scanning tools may help identify missing authorization boundaries.
Organizations can look for this issue through:
- Access-control tests verifying that a policymaker cannot configure or consume from unauthorized virtual hosts
- Code review checks for federation paths that validate URI syntax without validating vhost permissions
- Static analysis and policy rules requiring authorization checks before cross-tenant resource access
- Auditing federation policy changes, upstream definitions, and unusual message-drain activity
- Regression tests covering denied cross-vhost access and default acknowledgment behavior
Automated code review and configuration-scanning tools may help identify missing authorization boundaries.
