#VU38874 Information disclosure in RabbitMQ - CVE-2017-4966

Vulnerability identifier: #VU38874

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-4966

CWE-ID: CWE-200

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
RabbitMQ
Client/Desktop applications / Messaging software

Vendor: VMware, Inc

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

RabbitMQ: 1.5.0 - 3.6.7

---

External links
https://pivotal.io/security/cve-2017-4966

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.