CVE-2025-50200
📋 TL;DR
RabbitMQ versions 3.13.7 and prior log HTTP API authorization headers containing base64-encoded credentials in plaintext. This allows attackers with access to log files to decode and steal authentication credentials. Organizations using vulnerable RabbitMQ versions with HTTP API access are affected.
💻 Affected Systems
- RabbitMQ
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrative credentials, gain full control of RabbitMQ, access sensitive messages, and potentially pivot to other systems.
Likely Case
Credential theft leading to unauthorized access to RabbitMQ management, message queues, and configuration data.
If Mitigated
Limited to log file access only; proper access controls prevent credential misuse.
🎯 Exploit Status
Exploitation requires access to log files; base64 decoding is trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.8
Vendor Advisory: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Upgrade RabbitMQ to version 4.0.8 or later. 3. Restart RabbitMQ service. 4. Verify upgrade and functionality.
🔧 Temporary Workarounds
Disable HTTP API logging
allConfigure RabbitMQ to exclude authorization headers from logs
rabbitmqctl set_log_level error
Configure logback.xml to filter Authorization headers
Restrict log file access
linuxSet strict file permissions on RabbitMQ log directories
chmod 640 /var/log/rabbitmq/*
chown rabbitmq:rabbitmq /var/log/rabbitmq/*
🧯 If You Can't Patch
- Implement strict access controls on RabbitMQ log directories and files
- Monitor log files for unauthorized access attempts and credential extraction
🔍 How to Verify
Check if Vulnerable:
Check RabbitMQ version and examine log files for base64-encoded Authorization headers after HTTP API requests.Check Version:
rabbitmqctl versionVerify Fix Applied:
After upgrade to 4.0.8+, verify version and test that Authorization headers no longer appear in logs.📡 Detection & Monitoring
Log Indicators:
- Base64 strings containing 'Authorization: Basic' in RabbitMQ logs
- Unexpected access to log files
Network Indicators:
- Unusual HTTP API authentication attempts from new sources
SIEM Query:
source="rabbitmq.log" AND "Authorization: Basic"