CVE-2017-15702: Authentication Spoofing in Apache Qpid Broker

The core of this vulnerability lies in the broker's configuration when multiple authentication providers are used on different ports, including an HTTP port. An attacker can connect to the HTTP port and, through crafted requests, induce the broker to use an authentication provider configured on a different port. While the attacker still requires valid credentials for the spoofed authentication provider, the ability to bypass intended security measures is significant. This is particularly concerning if the spoofed port has weaker authentication controls, such as anonymous access or default credentials. The potential impact includes unauthorized access to message queues, data breaches, and potentially, lateral movement within the network if the broker is integrated with other systems. The attack pattern shares similarities with other authentication bypass vulnerabilities where misconfigurations enable unauthorized access.

1. Published2018-10-19
2. Modified2024-12-03
3. EPSS updated2026-04-02

The primary mitigation for CVE-2017-15702 is to upgrade to Apache Qpid Broker-J version 6.0.0 or later, which includes the fix. If immediate upgrading is not feasible, carefully review and reconfigure the broker's authentication provider setup. Ensure that authentication providers are not configured on ports that are easily accessible or have weak security controls. Specifically, avoid using HTTP ports for authentication when stronger authentication mechanisms are available. Implement strict network segmentation to limit access to the broker. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the authentication endpoints. Monitor broker logs for suspicious authentication attempts.