RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 / 4.3.x < 4.3.1 Atom Exhaustion via Global Parameter Name

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362553);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-67227");
  script_xref(name:"IAVA", value:"2026-A-1075");

  script_name(english:"RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 / 4.3.x < 4.3.1 Atom Exhaustion via Global Parameter Name");

  script_set_attribute(attribute:"synopsis", value:
"The RabbitMQ installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.22, or 4.1.x prior to 4.1.14, or 4.2.x prior
to 4.2.7, or 4.3.x prior to 4.3.1. It is, therefore, affected by a denial of service vulnerability:

  - resource_exists/2, and the PUT and DELETE handlers, call rabbit_data_coercion:to_atom/1 on the :name URL path
    segment of the global parameters endpoint, and to_atom/1 uses the unsafe binary_to_atom/2. A user holding only the
    policymaker tag can crash the node by exhausting the atom table through repeated requests to
    /api/global-parameters/:name with unique names. (CVE-2026-67227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q7x8-97rh-cr24
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?92d83c25");
  script_set_attribute(attribute:"solution", value:
"Upgrade to RabbitMQ version 4.0.22, 4.1.14, 4.2.7, 4.3.1, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67227");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:rabbitmq");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:rabbitmq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rabbitmq_server_nix_installed.nbin", "vmware_rabbitmq_win_installed.nbin");
  script_require_keys("installed_sw/RabbitMQ", "Settings/ParanoidReport");

  exit(0);
}
include('vdf.inc');

# Not checking if the management plugin is enabled
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'RabbitMQ', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '4.0.0', 'fixed_version': '4.0.22'},
        {'min_version': '4.1.0', 'fixed_version': '4.1.14'},
        {'min_version': '4.2.0', 'fixed_version': '4.2.7'},
        {'min_version': '4.3.0', 'fixed_version': '4.3.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);