RabbitMQ XSS attack

Successful exploitation of CVE-2019-11281 allows an attacker with administrative privileges to execute arbitrary JavaScript code within the context of a RabbitMQ user's browser. This can lead to the theft of session cookies, enabling the attacker to impersonate the user and gain unauthorized access to RabbitMQ management functions. The attacker could potentially view and modify virtual host configurations, queue settings, and other critical policy information. While the vulnerability requires authentication, the administrative access needed makes it a significant risk within environments where privileged accounts are not properly secured. The blast radius is limited to the RabbitMQ management interface and the data accessible within that context.

Organizations utilizing RabbitMQ for message queuing, particularly those with administrative access granted to users who may be susceptible to social engineering or phishing attacks, are at risk. Environments with legacy RabbitMQ installations running versions prior to 3.7.18 are especially vulnerable.

• linux / server: Examine RabbitMQ access logs for unusual patterns or suspicious URLs containing JavaScript code. Use grep to search for patterns like <script> or javascript: within the logs.

grep -i '<script' /var/log/rabbitmq/error.log

• generic web: Use curl to test the virtual host limits page and federation management UI for XSS vulnerabilities. Attempt to inject simple payloads and observe the response.

curl 'http://rabbitmq-server/admin/virtualhosts/limits?param=<script>alert("XSS")</script>' 

1. 2019-10-16Disclosure

   disclosure

1. Reserviert2019-04-18
2. Veröffentlicht2019-10-16
3. Geändert2024-09-16
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-11281 is to upgrade RabbitMQ to version 3.7.18 or later. If an immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with administrative privileges. Additionally, implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting the virtual host limits page and federation management UI. Regularly review and audit RabbitMQ configurations to ensure adherence to security best practices. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the virtual host limits page and verifying that the script is not executed.