CVE-2023-46118: Denial of Service by publishing large messages over the HTTP API
Summary
Responsibly disclosed by @NSEcho.
HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.
Details
An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism.
A PoC was provided to Team RabbitMQ privately.
Impact
Denial of Service
Other sources
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rabbitmq-serverto a version that resolves this vulnerability.Fixed in 3.8.2-1+deb10u2Fixed in 3.8.9-3+deb11u1Fixed in 3.10.8-1.1+deb12u1Fixed in 3.10.8-3 - Upgrade
Upgrade
erlang/rabbit_commonto a version that resolves this vulnerability.Fixed in 3.11.24 - Upgrade
Upgrade
erlang/rabbit_commonto a version that resolves this vulnerability.Fixed in 3.12.7 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.11.24 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.12.7
Event History
Frequently Asked Questions
What is the vulnerability ID for this RabbitMQ vulnerability?
The vulnerability ID for this RabbitMQ vulnerability is CVE-2023-46118.
What is the severity of the CVE-2023-46118 vulnerability?
The severity of the CVE-2023-46118 vulnerability is medium with a severity value of 4.9.
What is the affected software for the CVE-2023-46118 vulnerability?
The affected software for the CVE-2023-46118 vulnerability is VMware RabbitMQ versions 3.11.24 to 3.12.7.
How does this vulnerability impact RabbitMQ?
This vulnerability allows an authenticated user with sufficient credentials to publish very large messages over the HTTP API, leading to denial of service (DoS) attacks.
Is there a fix available for the CVE-2023-46118 vulnerability?
Yes, the fix for the CVE-2023-46118 vulnerability is provided by upgrading to a version of VMware RabbitMQ that is not affected, such as version 3.12.8 or later.