CVE-2023-24448: Missing permission check in Jenkins RabbitMQ Consumer Plugin
Summary
CVE-2023-24448: Missing permission check in Jenkins RabbitMQ Consumer Plugin. Affects org.jenkins-ci.plugins:rabbitmq-consumer versions < 2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins RabbitMQ Consumer Plugin is a Maven package that allows Jenkins to consume messages from RabbitMQ. It provides functionality for connecting to an AMQP(S) URL using a specified username and password. The plugin is widely used in Jenkins environments for message queue integration.
Vulnerability Detail
A missing permission check in Jenkins RabbitMQ Consumer Plugin versions 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using an attacker-specified username and password. This vulnerability can be exploited by an authenticated user with the mentioned permission to gain unauthorized access to the RabbitMQ server and potentially perform malicious actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a non-vulnerable version of the Jenkins RabbitMQ Consumer Plugin.
Conclusion
The missing permission check vulnerability in Jenkins RabbitMQ Consumer Plugin versions 2.8 and earlier can allow attackers with Overall/Read permission to gain unauthorized access to a RabbitMQ server. It is crucial for users to upgrade to version 2.9 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rabbitmq-consumer →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to a specified AMQP(S) URL using an attacker-specified username and password. It can lead to unauthorized access to the RabbitMQ server and potential misuse of its functionalities.
Users of Jenkins RabbitMQ Consumer Plugin versions 2.8 and earlier are affected by this vulnerability. Specifically, attackers with Overall/Read permission can exploit this issue.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to apply the recommended fix to prevent potential exploitation.
Yes, the Jenkins RabbitMQ Consumer Plugin maintainers have released a patch in version 2.9 that addresses this vulnerability. Users should update their installations to the latest version available.
There are no known mitigations for this vulnerability. Upgrading to a non-vulnerable version of the Jenkins RabbitMQ Consumer Plugin is the recommended course of action.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rabbitmq-consumer.
