Cloudanix VulnDB

CVE-2017-4966

High · 7.8

CVSS

7.8

EPSS

0.4%

Published

Jun 13, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A messaging system's web management tool keeps login details stored inside web browsers without clearing them, so anyone who later looks inside that browser could steal the logins and access the system.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes the RabbitMQ management UI to persist signed-in user credentials indefinitely in browser localStorage without expiration, enabling retrieval via chained attacks such as XSS or local browser access.

Why it matters to the business

Organizations relying on affected messaging infrastructure face elevated risk of credential theft leading to unauthorized system access and potential data exposure; however the CVE's age, stable low EPSS, and lack of KEV status indicate limited active threat, though downstream package prevalence in nri-kafka ecosystems warrants attention to upgrade cycles.

How an attack unfolds

An attacker first obtains a way to inspect the victim's browser storage through social engineering, malware, or a web-based vector, then extracts the unexpired credentials stored by the management UI and reuses them to authenticate and perform actions within the RabbitMQ environment.

How to fix it

Upgrade all affected packages to the listed fixed versions: nri-kafka (Chainguard) to 0, nri-kafka (Wolfi) to 0, nri-kafka-compat (Chainguard) to 0, and nri-kafka-compat (Wolfi) to 0; additionally migrate RabbitMQ deployments beyond the vulnerable 3.4.x/3.5.x/3.6.x ranges to 3.6.9 or newer.

How to confirm the fix worked

Confirm deployed package versions match or exceed the fixed releases; inspect browser localStorage after logout to ensure credential entries are absent and have proper expiration handling.

Typical attack path

  1. Obtain access to target browser localStorage via chained vector
  2. Locate and extract stored RabbitMQ management credentials
  3. Replay extracted credentials to authenticate to the management UI
  4. Escalate privileges or exfiltrate messaging data

How to detect it

Review browser localStorage artifacts for persistent RabbitMQ credential objects; examine web server and management UI access logs for logins from unexpected locations or after supposed session termination.

What your security team should do

  • Prioritize package upgrades to the exact fixed versions provided for nri-kafka variants
  • Audit all RabbitMQ management UI instances for residual localStorage entries
  • Implement session timeout and credential hygiene policies in web management tools
  • Monitor EPSS and KEV updates given the CVE's long publication history

The record

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 rabbitmq-server 0 3.6.10-1
Debian:11 rabbitmq-server 0 3.6.10-1
Debian:12 rabbitmq-server 0 3.6.10-1
Debian:13 rabbitmq-server 0 3.6.10-1
Debian:9 rabbitmq-server 0 3.6.6-1+deb9u1
Ubuntu:18.04:LTS rabbitmq-server 0 3.6.10-1
Ubuntu:Pro:16.04:LTS rabbitmq-server 0 3.5.7-1ubuntu0.16.04.4+esm2

Related vulnerabilities