Apache Qpid Broker vulnerable to authentication port spoofing

The core of this vulnerability lies in the broker's configuration when multiple authentication providers are used on different ports, including an HTTP port. An attacker can connect to the HTTP port and, through crafted requests, induce the broker to use an authentication provider configured on a different port. While the attacker still requires valid credentials for the spoofed authentication provider, the ability to bypass intended security measures is significant. This is particularly concerning if the spoofed port has weaker authentication controls, such as anonymous access or default credentials. The potential impact includes unauthorized access to message queues, data breaches, and potentially, lateral movement within the network if the broker is integrated with other systems. The attack pattern shares similarities with other authentication bypass vulnerabilities where misconfigurations enable unauthorized access.

Organizations utilizing Apache Qpid Broker-J in environments with multiple authentication providers configured across different ports are at significant risk. This includes deployments where HTTP ports are used for authentication or where default authentication configurations are in place. Shared hosting environments using Qpid Broker-J are also particularly vulnerable due to the potential for misconfigurations.

• java / server:

ps aux | grep qpid-broker

• java / server:

journalctl -u qpid-broker -f | grep "Authentication provider"

• generic web:

curl -I http://<qpid-broker-ip>:<port>/ | grep Authentication

1. 2018-10-19Disclosure

   disclosure

1. Publicada2018-10-19
2. Modificada2024-12-03
3. EPSS atualizado2026-04-02

The primary mitigation for CVE-2017-15702 is to upgrade to Apache Qpid Broker-J version 6.0.0 or later, which includes the fix. If immediate upgrading is not feasible, carefully review and reconfigure the broker's authentication provider setup. Ensure that authentication providers are not configured on ports that are easily accessible or have weak security controls. Specifically, avoid using HTTP ports for authentication when stronger authentication mechanisms are available. Implement strict network segmentation to limit access to the broker. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the authentication endpoints. Monitor broker logs for suspicious authentication attempts.