RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
### Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. ### Details An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. A PoC was provided to Team RabbitMQ privately. ### Impact Denial of Service
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-46118US | medium4.9 | — | ||
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/rabbitmq/rabbitmq-serverPACKAGE
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpgWEB
- https://lists.debian.org/debian-lts-announce/2023/12/msg00009.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-46118ADVISORY
- https://www.debian.org/security/2023/dsa-5571WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan