RabbitMQ 3.13.x < 3.13.18 / 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362548);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-67223", "CVE-2026-67239", "CVE-2026-67409");
  script_xref(name:"IAVA", value:"2026-A-1075");

  script_name(english:"RabbitMQ 3.13.x < 3.13.18 / 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The RabbitMQ installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of RabbitMQ installed on the remote host is 3.13.x prior to 3.13.18, or 4.0.x prior to 4.0.23, or 4.1.x
prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple
vulnerabilities:

  - The JWKS key fetching mechanism in uaa_jwt.erl does not validate the HTTP response status code when downloading
    signing keys from the OAuth 2 provider's JWKS endpoint. Non-200 responses are processed identically to successful
    ones, so an error body that lacks a keys field destroys all previously cached signing keys, causing a persistent
    authentication denial of service for all OAuth 2 and JWT users. (CVE-2026-67409)

  - The LDAP authentication backend performs literal string substitution of ${username} into user_dn_pattern without
    applying RFC 4514 DN escaping. Special characters in the username are not escaped, so a crafted username can shift
    the bind DN into a different organizational unit and potentially resolve to a different, more privileged directory
    entry. (CVE-2026-67223)

  - The stream management UI renders the TLS peer certificate subject and issuer distinguished names without output
    escaping, allowing an attacker who can obtain a certificate signed by a CA that the stream TLS listener trusts, with
    an attacker-chosen DN, to store script that executes when an operator views the stream connection detail page.
    (CVE-2026-67239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9x7r-g78c-5835
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fee12853");
  # https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-xm9p-57xv-vxwc
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc637408");
  # https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1c6853b1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to RabbitMQ version 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67409");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:rabbitmq");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:rabbitmq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rabbitmq_server_nix_installed.nbin", "vmware_rabbitmq_win_installed.nbin");
  script_require_keys("installed_sw/RabbitMQ", "Settings/ParanoidReport");

  exit(0);
}
include('vdf.inc');

# Not checking if the LDAP auth backend, OAuth 2 JWKS key discovery, or a verify_peer stream TLS listener are configured
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'RabbitMQ', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '3.13.0', 'fixed_version': '3.13.18'},
        {'min_version': '4.0.0', 'fixed_version': '4.0.23'},
        {'min_version': '4.1.0', 'fixed_version': '4.1.14'},
        {'min_version': '4.2.0', 'fixed_version': '4.2.9'},
        {'min_version': '4.3.0', 'fixed_version': '4.3.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, flags:{"xss":TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);