RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
### Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. ### Details An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. A PoC was provided to Team RabbitMQ privately. ### Impact Denial of Service
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-46118US | medium4.9 | — | ||
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/rabbitmq/rabbitmq-serverPACKAGE
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpgWEB
- https://lists.debian.org/debian-lts-announce/2023/12/msg00009.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-46118ADVISORY
- https://www.debian.org/security/2023/dsa-5571WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan