PT-2022-11911 · Rabbitmq+1 · Rabbitmq+1

Alexmv · Published 2022-01-25 · Updated 2022-02-02 · CVE-2021-43799

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 4.9

Description Zulip Server is an open-source team collaboration tool that installs RabbitMQ for internal message passing. The initial installation of Zulip Server prior to version 4.9 does not successfully limit the default ports opened by RabbitMQ, including port 25672, the RabbitMQ distribution port. This port is protected by a default "cookie" generated using a weak PRNG, resulting in approximately 20 bits of entropy. If not protected by other firewalls, a remote attacker can brute-force the "cookie" and execute arbitrary code as the rabbitmq user, as well as read all data sent through RabbitMQ, including user message traffic.

Recommendations For versions prior to 4.9, ensure that firewalls prevent access to ports 5672 and 25672 from outside the Zulip server as a workaround. Update to version 4.9, which contains a patch for this issue.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2021-43799

GHSA-P663-WXVV-2FJP

Affected Products

Rabbitmq

Zulip Server

References · 7

• https://github.com/zulip/zulip/commit/a5496f4098e3998c9b84e8dc564aa983d6cdf6e8 · Patch
• https://osv.dev/vulnerability/CVE-2021-43799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43799 · Security Note
• https://github.com/zulip/zulip/releases/tag/4.9 · Note
• https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp · Note
• https://github.com/gteissier/erl-matter · Note
• https://t.me/cibsecurity/36273 · Telegram Post