RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362551);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-67408");

  script_name(english:"RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service");

  script_set_attribute(attribute:"synopsis", value:
"The RabbitMQ installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of RabbitMQ installed on the remote host is 4.1.x prior to 4.1.11, or 4.2.x prior to 4.2.9, or 4.3.x prior
to 4.3.3. It is, therefore, affected by a denial of service vulnerability:

  - The stream management HTTP API handler for super stream creation (PUT /api/stream/super-streams/{vhost}/{name})
    builds the full list of streams from the client-supplied binding-keys field before it checks the user's resource
    permissions. An authenticated management user with access to the vhost, but with no configure, write, or read
    permission, can therefore force large memory allocations and crash a node that runs under a memory limit.
    (CVE-2026-67408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?31cd6cd1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to RabbitMQ version 4.1.11, 4.2.9, 4.3.3, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67408");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:rabbitmq");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:rabbitmq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rabbitmq_server_nix_installed.nbin", "vmware_rabbitmq_win_installed.nbin");
  script_require_keys("installed_sw/RabbitMQ", "Settings/ParanoidReport");

  exit(0);
}
include('vdf.inc');

# Not checking if the stream plugin is enabled
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'RabbitMQ', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '4.1.0', 'fixed_version': '4.1.11'},
        {'min_version': '4.2.0', 'fixed_version': '4.2.9'},
        {'min_version': '4.3.0', 'fixed_version': '4.3.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);