Summary

RabbitMQ seems to be logging authorization header in plaintext (encoded in base64) when error arises, e.g. non-existent queue

Details

When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers - Showing base64 encoded username:password - which is easy to decode and afterwards used to obtain control to the system (depending on the type of credentials).

Found on

• OS: Windows
• RabbitMQ 3.13.7 and 3.13.2
• Erlang 26.2.5

PoC

• Created new admin user "tmp" with pwd "tmp" via rabbitmq management console:

• Created a GET request in pwsh using basic authentication to non-existent queue

• Executed pwsh script PoCRabbitMQ.txt

$Username = "tmp"
$Password = "tmp"

$QueueName = "RANDOM"
$Url = "http://localhost:15672/api/queues/%2F/$QueueName/get"

# Encode credentials
$EncodedCredentials = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("$Username`:$Password"))
$Headers = @{
    "Authorization" = "Basic $EncodedCredentials"
    "Content-Type" = "application/json"
}

# Request body
$Body = @{
    "count" = 10
    "requeue" = $false
    "encoding" = "auto"
} | ConvertTo-Json -Compress

# Send request
$Response = Invoke-WebRequest -Uri $Url -Method Post -Headers $Headers -Body $Body

# Print messages
$Messages = $Response.Content | ConvertFrom-Json
$Messages | ForEach-Object { Write-Output "Message: $($_.payload)" }

• Checked the logs of RabbitMQ and found the error logs with the authorization headers:

[error] .... 
headers =>
    #{<<"authorization">> =>
    <<"Basic ......

Impact

Information Disclosure of credentials of users whose actions may raise an error - like searching queue that does not exist.