Cross-site scripting in RabbitMQ Server - CVE-2021-32719

Vulnerability identifier: #VU54421

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-32719

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "rabbitmq_federation_management" plugin. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

RabbitMQ Server
Red Hat OpenStack
Arch Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Module for Server Applications
Server Applications Module
openSUSE Leap
Ubuntu
elixir115
elixir115-doc
rabbitmq-server (Ubuntu package)
rabbitmq-server
rabbitmq-server-plugins
erlang-rabbitmq-client
rabbitmq-server (Red Hat package)
rabbitmq-server313-zsh-completion
rabbitmq-server313-bash-completion
rabbitmq-server313
erlang-rabbitmq-client313
rabbitmq-server313-plugins
erlang26-wx-src
erlang26-debugger
erlang26-dialyzer-debuginfo
erlang26-diameter
erlang26-epmd
erlang26-jinterface-src
erlang26-reltool-src
erlang26-wx-debuginfo
erlang26-dialyzer
erlang26
erlang26-wx
erlang26-doc
erlang26-dialyzer-src
erlang26-et-src
erlang26-observer-src
erlang26-debugsource
erlang26-debugger-src
erlang26-src
erlang26-diameter-src
erlang26-observer
erlang26-epmd-debuginfo
erlang26-jinterface
erlang26-et
erlang26-reltool
erlang26-debuginfo

Install updates from vendor's website.

RabbitMQ Server - update to 3.8.18
elixir115 - update to 1.15.7-150300.7.5.1
elixir115-doc - update to 1.15.7-150300.7.5.1
rabbitmq-server (Ubuntu package) - update to 3.8.3-0ubuntu0.2
rabbitmq-server - update to 3.8.3-3.3.4
rabbitmq-server-plugins - update to 3.8.3-3.3.4
erlang-rabbitmq-client - update to 3.8.3-3.3.4
rabbitmq-server (Red Hat package) - update to 3.8.16-3.el8ost
rabbitmq-server313-zsh-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313-bash-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313 - update to 3.13.1-150600.13.5.3
erlang-rabbitmq-client313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-plugins - update to 3.13.1-150600.13.5.3
Red Hat OpenStack - update to 16.2.4
erlang26-wx-src - update to 26.2.1-150300.7.5.1
erlang26-debugger - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-diameter - update to 26.2.1-150300.7.5.1
erlang26-epmd - update to 26.2.1-150300.7.5.1
erlang26-jinterface-src - update to 26.2.1-150300.7.5.1
erlang26-reltool-src - update to 26.2.1-150300.7.5.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-dialyzer - update to 26.2.1-150300.7.5.1
erlang26 - update to 26.2.1-150300.7.5.1
erlang26-wx - update to 26.2.1-150300.7.5.1
erlang26-doc - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.5.1
erlang26-et-src - update to 26.2.1-150300.7.5.1
erlang26-observer-src - update to 26.2.1-150300.7.5.1
erlang26-debugsource - update to 26.2.1-150300.7.5.1
erlang26-debugger-src - update to 26.2.1-150300.7.5.1
erlang26-src - update to 26.2.1-150300.7.5.1
erlang26-diameter-src - update to 26.2.1-150300.7.5.1
erlang26-observer - update to 26.2.1-150300.7.5.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-jinterface - update to 26.2.1-150300.7.5.1
erlang26-et - update to 26.2.1-150300.7.5.1
erlang26-reltool - update to 26.2.1-150300.7.5.1
erlang26-debuginfo - update to 26.2.1-150300.7.5.1

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x

• Cross-site scripting in RabbitMQ Server
• Arch Linux update for rabbitmq
• SUSE Linux Enterprise Module for Server Applications update for rabbitmq-server
• SUSE update for rabbitmq-server
• Red Hat OpenStack Platform 16.2 update for rabbitmq-server
• SUSE update for Feature update for rabbitmq-server313, erlang26, elixir115
• Ubuntu update for rabbitmq-server