RabbitMQ 'rabbit_mgmt_util.erl' Security Bypass Vulnerability

  1. Network Vulnerabilities
  2. Web application abuses
  3. RabbitMQ 'rabbit_mgmt_util.erl' Security Bypass Vulnerability
Summary
RabbitMQ is prone to a security-bypass vulnerability.
Impact
An attacker can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.
Solution
Updates are available.
Insight
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
Affected
RabbitMQ 3.3.0 is vulnerable. Other versions may also be affected.
Detection
Send a HTTP GET request with a fake X-Forwarded-For header and check the response
Severity
Medium Severity
Classification
Related Vulnerabilities