CVE-2021-43799
📋 TL;DR
This vulnerability in Zulip Server allows remote attackers to brute-force RabbitMQ's weak authentication cookie (only ~20 bits of entropy) to gain code execution as the rabbitmq user and read all message traffic. It affects Zulip Server installations prior to version 4.9 where port 25672 is exposed without proper firewalling.
💻 Affected Systems
- Zulip Server
📦 What is this software?
Zulip by Zulip
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of RabbitMQ service, executes arbitrary code as rabbitmq user, reads all user message traffic, and potentially pivots to other systems.
Likely Case
Attacker reads all message traffic passing through RabbitMQ and gains control of the RabbitMQ service.
If Mitigated
If port 25672 is properly firewalled, the vulnerability cannot be exploited remotely.
🎯 Exploit Status
Brute-force attack against weak 20-bit entropy cookie. Public exploit tools like erl-matter exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9
Vendor Advisory: https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp
Restart Required: Yes
Instructions:
1. Upgrade Zulip Server to version 4.9 or later. 2. Restart RabbitMQ service or reboot the server.
🔧 Temporary Workarounds
Firewall port 25672
linuxBlock external access to RabbitMQ distribution port 25672
sudo iptables -A INPUT -p tcp --dport 25672 -j DROP
sudo iptables -A INPUT -p tcp --dport 5672 -j DROP
🧯 If You Can't Patch
- Ensure firewalls block external access to ports 25672 and 5672
- Restart RabbitMQ service or reboot server to apply proper port restrictions
🔍 How to Verify
Check if Vulnerable:
Check if Zulip Server version is below 4.9 AND port 25672 is accessible without firewall protection.Check Version:
cat /home/zulip/deployments/current/version.py | grep ZULIP_VERSIONVerify Fix Applied:
Verify Zulip Server version is 4.9+ AND port 25672 is not accessible from external networks.📡 Detection & Monitoring
Log Indicators:
- Failed RabbitMQ authentication attempts on port 25672
- Unusual RabbitMQ process activity
Network Indicators:
- External connections to port 25672
- Brute-force patterns against port 25672
SIEM Query:
destination_port=25672 AND (authentication_failure OR connection_attempts > threshold)🔗 References
- https://github.com/gteissier/erl-matter
- https://github.com/zulip/zulip/commit/a5496f4098e3998c9b84e8dc564aa983d6cdf6e8
- https://github.com/zulip/zulip/releases/tag/4.9
- https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp
- https://github.com/gteissier/erl-matter
- https://github.com/zulip/zulip/commit/a5496f4098e3998c9b84e8dc564aa983d6cdf6e8
- https://github.com/zulip/zulip/releases/tag/4.9
- https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp
