CVE-2022-31008: RabbitMQ Information Disclosure Flaw

CVE-2022-31008 Overview

CVE-2022-31008 is a cryptographic vulnerability affecting RabbitMQ, a multi-protocol messaging and streaming broker. The Shovel and Federation plugins perform URI obfuscation in their worker (link) state, but the encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log, potentially exposing sensitive connection information.

Critical Impact

Sensitive URI data including credentials could be exposed through node logs due to weak encryption key seeding, allowing attackers with log access to deobfuscate connection strings.

Affected Products

• Broadcom RabbitMQ Server (versions prior to 3.10.2)
• Broadcom RabbitMQ Server (versions prior to 3.9.18)
• VMware RabbitMQ (versions prior to 3.8.32)

Discovery Timeline

• 2022-10-06 - CVE CVE-2022-31008 published to NVD
• 2025-04-02 - Last updated in NVD database

Technical Details for CVE-2022-31008

Vulnerability Analysis

This vulnerability stems from insecure random number generation (CWE-330) and improper seeding of pseudo-random number generators (CWE-335). The Shovel and Federation plugins in RabbitMQ are designed to obfuscate sensitive URI information when storing connection state. However, the implementation used a predictable secret to seed the encryption key, fundamentally undermining the security of the obfuscation mechanism.

When certain exceptions occur within the Shovel and Federation plugins, the worker state—including the obfuscated URIs—may be written to node logs. Because the encryption key was derived from a predictable seed, an attacker with access to these logs could reverse the obfuscation process and recover the original URI data, which may contain authentication credentials and connection details.

Root Cause

The root cause of this vulnerability lies in the use of a predictable secret for seeding the encryption key used in URI obfuscation. Instead of using a cryptographically secure, cluster-wide secret, the affected versions used a value that could be determined or guessed by an attacker. This represents a fundamental cryptographic weakness where the security of the obfuscation depends on the secrecy of the seed, which was not adequately protected.

Attack Vector

The attack requires network access to obtain RabbitMQ node logs where the obfuscated URIs may be exposed during exception handling. An attacker who gains access to these logs—through log aggregation systems, backup files, or direct server access—can analyze the obfuscated data. Because the encryption seed is predictable, the attacker can reconstruct the encryption key and deobfuscate the URI data to recover sensitive connection credentials.

The vulnerability is exploitable without authentication to the RabbitMQ server itself, as the attack targets exposed log data rather than the running service. The attack requires no user interaction and affects confidentiality of sensitive connection information.

Detection Methods for CVE-2022-31008

Indicators of Compromise

• Unusual access patterns to RabbitMQ log files or log aggregation systems
• Evidence of log file exfiltration or unauthorized log access
• Unexpected queries against centralized logging platforms for RabbitMQ-related entries
• Signs of credential reuse or unauthorized access to systems using RabbitMQ federation credentials

Detection Strategies

• Monitor file access logs for RabbitMQ node log files to detect unauthorized reads
• Implement alerting on log aggregation system access patterns for RabbitMQ-related data
• Review authentication logs for systems connected via Shovel or Federation plugins for signs of credential compromise
• Audit access controls on systems that store or process RabbitMQ logs

Monitoring Recommendations

• Enable comprehensive logging and monitoring on RabbitMQ server infrastructure
• Implement file integrity monitoring on RabbitMQ log directories
• Configure alerts for bulk log file access or export operations
• Monitor for lateral movement following potential credential exposure from RabbitMQ connection URIs

How to Mitigate CVE-2022-31008

Immediate Actions Required

• Upgrade RabbitMQ to patched versions: 3.10.2, 3.9.18, or 3.8.32 or later immediately
• If unable to upgrade, disable the Shovel and Federation plugins until patching is possible
• Review and rotate any credentials that may have been exposed through RabbitMQ logs
• Audit access logs for RabbitMQ node logs to identify potential unauthorized access

Patch Information

Patched versions are available that correctly use a cluster-wide secret for URI obfuscation. Organizations should upgrade to RabbitMQ versions 3.10.2, 3.9.18, or 3.8.32 or later depending on their release branch. The fix is documented in the RabbitMQ GitHub Pull Request #4841. Additional details are available in the GitHub Security Advisory GHSA-v9gv-xp36-jgj8.

Workarounds

• Disable the Shovel plugin by running rabbitmq-plugins disable rabbitmq_shovel if federation features are not required
• Disable the Federation plugin by running rabbitmq-plugins disable rabbitmq_federation if not in use
• Implement strict access controls on RabbitMQ log files and directories
• Consider encrypting log storage and limiting retention of logs that may contain sensitive data

# Disable vulnerable plugins as a workaround
rabbitmq-plugins disable rabbitmq_shovel
rabbitmq-plugins disable rabbitmq_federation

# Verify plugins are disabled
rabbitmq-plugins list --enabled