GHSA-pj33-75x5-32j4
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Hex | rabbit_common | >= 3.12.7, < 3.12.11 | 3.12.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Queue deletion via the HTTP API was not verifying the `configure` permission of the user.
### Impact
Users who had all of the following:
1. Valid credentials
2. Some permissions for the target virtual host
3. HTTP API access
could delete queues it had no (deletion) permissions for.
### Workarounds
Disable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring.
### OWASP Classification
OWASP Top10 A01:2021 – Broken Access Control
References
External links from the advisory. They lead to third-party sites.