AMQP 1.0 post-body properties bypass user-ID validation and reach consumers

Summary

RabbitMQ's AMQP 1.0 server parser stops as soon as it encounters the first
message body section. It does not validate the remaining message section
order. The unparsed tail is stored and forwarded byte-for-byte.

An authenticated AMQP 1.0 publisher can send a valid body followed by a
properties section containing a forged user-id. RabbitMQ treats the
message as having no user-id when it executes its authenticated publisher
check. Downstream AMQP 1.0 clients that do not enforce section ordering parse
the late properties and expose the forged identity to the consumer. RabbitMQ's
AMQP 1.0-to-0-9-1 conversion path also installs the late properties, exposing
the forged user-id to AMQP 0-9-1 consumers.

This creates a message parser differential across RabbitMQ's validation
boundary:

RabbitMQ validation view: user-id is absent
Consumer view:             user-id is attacker-controlled

The repository's own AMQP 1.0 client accepts properties after the body and
exposes the forged user-id.

Affected revision

Confirmed against:

f02b3c6b52529d6809c56c2516f3dc4333605688

Confirmed with Erlang/OTP 27.

The affected release range has not been established. This report only claims
the revision above.

Affected components

• deps/amqp10_common/src/amqp10_binary_parser.erl
• deps/rabbit/src/mc_amqp.erl
• deps/rabbit/src/rabbit_amqp_session.erl
• deps/rabbit/src/rabbit_access_control.erl
• deps/amqp10_client/src/amqp10_msg.erl

##…