RabbitMQ administrator RCE through reflected Erlang distribution authentication

Summary

This advisory describes a complex attack that requires administrative access
to the HTTP API and a number of other variables to hold true.

A RabbitMQ management user with the administrator tag can escalate from
broker administration to arbitrary BEAM function execution without knowing the
Erlang distribution cookie and without local operating-system access.

The chain combines three behaviors:

1. Administrator-accessible global-parameter names are converted into new
   Erlang atoms. This lets the attacker intern two node names such as
   evil@attacker and oracle@attacker.
2. DELETE /api/reset/:node accepts any existing node atom and performs
   rabbit:is_running(Node) before checking whether the node is a cluster
   member. Two concurrent requests initiate two outbound Erlang distribution
   handshakes to attacker-controlled nodes.
3. OTP 27's legacy cookie digest is bound to the cookie and challenge but not
   the peer identity, connection direction, or complete transcript. The digest
   produced on one outbound connection can authenticate the other.

After authentication, the attacker can send a registered distribution message
to rex and choose the module, function, and argument list.

The proof is intentionally non-destructive: it invokes only
erlang:md5(Nonce) and verifies the returned digest.

This is an authenticated administrator RCE.

Preconditions

• Valid management credentials with the administrator tag.
• The RabbitMQ management pl…