Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Source references

deps/rabbitmq_management/src/rabbit_mgmt_wm_global_parameter.erl:71 · Atom Table Exhaustion

Impact

A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name values.

Description

resource_exists/2 (and the PUT/DELETE handlers) call rabbit_data_coercion:to_atom/1 on the :name URL path segment. to_atom/1 uses binary_to_atom/2 (unsafe). The endpoint requires policymaker (not management, but below administrator).

Exploit scenario

for i in $(seq 1 1000000); do curl -u policymaker:pw broker:15672/api/global-parameters/gp-$i; done. Each GET creates atom 'gp-$i' in resource_exists. VM aborts at ~1M.

Preconditions

• Management plugin enabled
• policymaker tag
• ~1M HTTP requests

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (5.9, Moderate). Fixed in 4.0.22, 4.1.14, 4.2.7, 4.3.1.