RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map.
The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes.
With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Attack Parameters
Impact Assessment
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 4
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Broadcom Rabbitmq_Server
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
|
3.13.0
|
3.13.15
|
|
Broadcom Rabbitmq_Server
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
|
4.0.0
|
4.0.20
|
|
Broadcom Rabbitmq_Server
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
|
4.1.0
|
4.1.11
|
|
Broadcom Rabbitmq_Server
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
|
4.2.0
|
4.2.6
|