CVE-2017-15702: Apache Qpid Broker Authentication Port Spoofing
Summary
CVE-2017-15702: Apache Qpid Broker vulnerable to authentication port spoofing. Affects org.apache.qpid:qpid-broker versions >= 0.18, < 6.0.0. Fixed in 6.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Broker-J is an open-source message broker that implements the Advanced Message Queuing Protocol (AMQP). It allows applications to communicate by exchanging messages in a reliable and secure manner. The broker supports multiple authentication providers on different ports, including an HTTP port. However, versions 0.18 through 0.32 of the broker are vulnerable to authentication port spoofing.
Vulnerability Detail
The vulnerability in Apache Qpid Broker-J allows a remote unauthenticated attacker to spoof the authentication port. By connecting to the HTTP port, the attacker can trick the broker into using an authentication provider that was configured on a different port. This can be a problem if the spoofed port has weaker authentication protection, such as anonymous access or default accounts. Normally, firewall rules or similar protections would prevent unauthorized access to the spoofed port, but this vulnerability circumvents those measures. It's important to note that only the AMQP ports are not affected by this vulnerability.
How To Fix
Minimum fixed version
6.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to upgrade to the fixed version of the Apache Qpid Broker-J.
Conclusion
Apache Qpid Broker-J versions 0.18 through 0.32 are vulnerable to authentication port spoofing, which can allow remote unauthenticated attackers to bypass authentication protections on the spoofed port. To mitigate this vulnerability, it is crucial to upgrade to version 6.0.0 or later of the Apache Qpid Broker-J. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:qpid-broker →
FAQ
Apache Qpid Broker-J is an open-source message broker that implements the Advanced Message Queuing Protocol (AMQP). It allows applications to communicate by exchanging messages in a reliable and secure manner.
Versions 0.18 through 0.32 of Apache Qpid Broker-J are vulnerable to authentication port spoofing.
Authentication port spoofing is a technique where an attacker tricks a system into using an authentication provider that was configured on a different port. In the case of Apache Qpid Broker-J, an attacker can connect to the HTTP port and spoof the authentication provider, potentially gaining unauthorized access.
No, only the HTTP port is vulnerable to authentication port spoofing. The AMQP ports are not affected.
There is no specific workaround provided for this vulnerability. It is recommended to upgrade to the fixed version of Apache Qpid Broker-J.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:qpid-broker.
