RabbitMQ Web STOMP: compressed pre-authentication messages exhaust broker memory
Résumé
Summary
RabbitMQ enables WebSocket permessage-deflate before STOMP authentication.
The unauthenticated WebSocket frame-size limit applies to each decompressed
WebSocket message independently, but the STOMP parser can accumulate one
incomplete STOMP body across thousands of WebSocket messa...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
認証されていない攻撃者が、WebSocketの圧縮機能を悪用して大量のメッセージを送り、RabbitMQのブローカーのメモリを使い尽くすおそれがあります。影響を受けるのはrabbitmq-serverで、修正版として4.2.10および4.3.5が公開されています。該当するバージョンを利用している場合は、これらの修正版へ速やかに更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| other | rabbitmq-server |
>= 4.2.0, < 4.2.10 |
4.2.10 |
| other | rabbitmq-server |
>= 4.3.0, < 4.3.5 |
4.3.5 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Summary
RabbitMQ enables WebSocket permessage-deflate before STOMP authentication.
The unauthenticated WebSocket frame-size limit applies to each decompressed
WebSocket message independently, but the STOMP parser can accumulate one
incomplete STOMP body across thousands of WebSocket messages.
An unauthenticated client can declare a large STOMP content-length, then send
many highly compressible 60 KiB WebSocket messages without completing the STOMP
frame. Parser continuations retain the decompressed body chunks up to the
default 100 MiB STOMP body limit per connection.
The retained data is primarily off-heap binary memory, so RabbitMQ's 16 MiB
unauthenticated process-heap limit does not terminate the connection. A small
number of connections can exhaust the broker before the normal 10-second login
timeout closes them.
Preconditions
rabbitmq_web_stompis enabled.- TCP port 15674, or an equivalent configured Web STOMP listener, is reachable.
- The listener negotiates
permessage-deflate, as it does by default. - No valid RabbitMQ credentials are required.
Root cause
1. Compression is enabled before authentication
%% deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:119-135
MaxFrameSize =
application:get_env(
rabbitmq_stomp, max_frame_size_unauthenticated,
?DEFAULT_MAX_FRAME_SIZE_UNAUTHENTICATED) + 4096,
WsOpts = maps:merge(#{compress => true,
max_frame_size => MaxFrameSize}, WsOpts0),
The…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY rabbitmq/rabbitmq-server