Shovel URI credentials disclosed to read-only monitoring users via the shovel management HTTP API

Summary

GET /api/shovels/vhost/{vhost}/{name} returns the raw stored dynamic-shovel definition, which contains src-uri and dest-uri with cleartext credentials for the shovel's source and destination brokers. The endpoint authorizes non-DELETE reads with the monitoring tag. A read-only monitoring user — who cannot create or manage shovels, and who is denied the equivalent read through the parameters API — can read another operator's external-broker passwords.

Details

The per-shovel management endpoint returns the stored runtime parameter verbatim, with no redaction, behind monitor-level authorization:

• deps/rabbitmq_shovel_management/src/rabbit_shovel_mgmt_shovel.erl: is_authorized/2 (:78-84) routes non-DELETE requests to rabbit_mgmt_util:is_authorized_monitor — the monitoring (or administrator) tag. to_json/2 (:73-76) returns rabbit_mgmt_format:parameter(Shovel) where Shovel is the raw rabbit_runtime_parameters:lookup/3 result from parameter/1 (:147-156).

The definition is stored unobfuscated. obfuscate_uris_in_definition/1 is invoked only when a worker spec is built, never on the storage or read path:

• deps/rabbitmq_shovel/src/rabbit_shovel_dyn_worker_sup_sup.erl:68,70 — the only call sites of obfuscate_uris_in_definition/1.
• deps/rabbitmq_shovel/src/rabbit_shovel_parameters.erl — validate/5 (:48) and notify/5 (:61) do not obfuscate; the term is written verbatim.
• `deps/rabbitmq_management_agent/src/rabbit…