CVE-2022-31008: Predictable credential obfuscation seed value used in rabbitmq-server
Impact
Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret.
This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.
Patched versions correctly use a cluster-wide secret for that purpose.
Patches
Patched versions:
3.10.2 3.9.18 3.8.32
Workarounds
Disable Shovel and Federation plugins.
Credits
RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions for responsibly disclosing and working with us on a patch for this vulnerability.
For more information
Mailing list Community Slack
Other sources
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/rabbit_commonto a version that resolves this vulnerability.Fixed in 3.8.32 - Upgrade
Upgrade
erlang/rabbit_commonto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
erlang/rabbit_commonto a version that resolves this vulnerability.Fixed in 3.10.2 - Upgrade
Upgrade
rabbitmq-serverto a version that resolves this vulnerability.Fixed in 3.10.2 - Upgrade
Upgrade
rabbitmq-serverto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
rabbitmq-serverto a version that resolves this vulnerability.Fixed in 3.8.32 - Configuration
Disable the Shovel plugin (workaround for users unable to upgrade).
RabbitMQ Shovel plugin plugin_enabled = false - Configuration
Disable the Federation plugin (workaround for users unable to upgrade).
RabbitMQ Federation plugin plugin_enabled = false
Event History
Frequently Asked Questions
What is CVE-2022-31008?
CVE-2022-31008 is a vulnerability in RabbitMQ where the shovel and federation plugins perform URI obfuscation in their worker state, using a predictable encryption key.
How can CVE-2022-31008 impact me?
CVE-2022-31008 can potentially allow an attacker to decrypt the obfuscated URI and gain unauthorized access to sensitive information or perform other malicious activities.
What versions of RabbitMQ are affected by CVE-2022-31008?
CVE-2022-31008 affects RabbitMQ versions up to and including 3.8.32, 3.9.0 to 3.9.18, and 3.10.0 to 3.10.2.
How do I fix CVE-2022-31008?
To fix CVE-2022-31008, upgrade your RabbitMQ installation to a version that is not affected by the vulnerability.
Are there any references for CVE-2022-31008?
Yes, you can find more information about CVE-2022-31008 in the following references: [Link 1](https://github.com/rabbitmq/rabbitmq-server/pull/4841) and [Link 2](https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8).