Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rabbitmq rabbitmq-server
>= 4.2.0, < 4.2.8affected>= 4.3.0, < 4.3.2affected
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778 ↗
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8 ↗
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2 ↗