rabbitmq/rabbitmq-server · Security
RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
- GHSA ID
- GHSA-w6cq-9cf4-gqpg
- CVE ID
- CVE-2023-46118
- Severity
- medium
- Published
- Updated
- CVSS
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Description
Summary
Responsibly disclosed by @NSEcho.
HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.
Details
An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism.
A PoC was provided to Team RabbitMQ privately.
Impact
Denial of Service
CWEs
- CWE-400 · Uncontrolled Resource Consumption
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-46118 ↗
- https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html ↗
- https://www.debian.org/security/2023/dsa-5571 ↗
- https://github.com/advisories/GHSA-w6cq-9cf4-gqpg ↗