Impact Summary

A sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with
other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users.

Detailed CVSS 3.1 score: 5.5 overall.

This attack was responsibly disclosed by a team of security researchers at Best of the Best 🇰🇷

Details

When a virtual host on a RabbitMQ node fails to start, recent versions
will display an error message (a notification) in the management UI. The error message includes virtual host name,
which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8.

An attack that both

1. Makes a virtual host fail to start, and
2. Creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk

could trigger arbitrary JavaScript code execution in the management UI (the user's browser).

Patches

Open source RabbitMQ 4.0.3.
Tanzu RabbitMQ 4.0.3 and 3.13.8.

Note that any future open source RabbitMQ 3.13.x releases will only be available to paying customers. All other users should upgrade to 4.0.x.

Workarounds

Disable the management plugin and use Prometheus and Grafana for monitoring

Credits

This vulnerability was researched and responsibly disclosed by a team at Best of the Best 🇰🇷

• Dain Lee @GodDa-In
• Eojin Lee @itsme-connected
• WooJin Park @jin-156
• MinJung Lee @PlppIle
• SeChang Oh @osc010524