CVE-2025-50200: RabbitMQ Information Disclosure Flaw

CVE-2025-50200 Overview

CVE-2025-50200 is an information disclosure vulnerability in RabbitMQ, a widely-used messaging and streaming broker. The vulnerability exists in versions 3.13.7 and prior, where RabbitMQ improperly logs HTTP authorization headers in plaintext (base64 encoded) when the API is queried with HTTP/HTTPS using basic authentication. This logging behavior exposes sensitive credentials that can be easily decoded, potentially allowing attackers with log file access to obtain system control depending on the compromised credentials.

Critical Impact

Attackers with access to RabbitMQ log files can extract base64-encoded credentials, decode them trivially, and potentially gain unauthorized access to the messaging broker and connected systems.

Affected Products

• Broadcom RabbitMQ Server versions 3.13.7 and prior
• RabbitMQ installations using HTTP/HTTPS API with basic authentication
• Systems with accessible RabbitMQ log files

Discovery Timeline

• June 19, 2025 - CVE-2025-50200 published to NVD
• August 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-50200

Vulnerability Analysis

This vulnerability falls under CWE-532 (Insertion of Sensitive Information into Log File), a common information disclosure weakness. When administrators or applications query the RabbitMQ API using HTTP or HTTPS with basic authentication, the server logs all request headers including the Authorization header. Basic authentication credentials are transmitted as base64-encoded username:password strings, which are trivially reversible. Any user or attacker with read access to these log files can extract and decode the credentials.

The local attack vector means that exploitation requires existing access to the system hosting RabbitMQ, either through legitimate means or prior compromise. However, the impact is significant as compromised RabbitMQ credentials could provide full administrative access to the messaging infrastructure, enabling attackers to intercept messages, modify routing, or disrupt critical business communications.

Root Cause

The root cause is improper handling of sensitive data in the logging subsystem. RabbitMQ's HTTP API handler logs complete request headers for debugging and audit purposes without filtering or masking the Authorization header. Base64 encoding provides no security as it is an encoding scheme, not encryption, and can be decoded instantly without any key material.

Attack Vector

The attack requires local access to the RabbitMQ server's log files. An attacker who has gained read access to the logging directory—whether through a separate vulnerability, misconfigured permissions, insider access, or log aggregation systems—can search for authorization headers in the logs. Once found, the base64-encoded credentials can be decoded using any standard base64 decoder. The attacker can then authenticate to the RabbitMQ API with the stolen credentials.

The exploitation flow involves:

1. Obtaining read access to RabbitMQ log files
2. Searching for HTTP request logs containing Authorization: Basic headers
3. Extracting the base64-encoded credential string
4. Decoding the base64 string to reveal username:password in plaintext
5. Using the credentials to authenticate to the RabbitMQ management API

Detection Methods for CVE-2025-50200

Indicators of Compromise

• Unexpected read access to RabbitMQ log files from unauthorized users or processes
• Authentication events from unusual IP addresses or at unusual times
• Log file access patterns indicating bulk reading or searching behavior
• API access using credentials that have not been recently legitimately used

Detection Strategies

• Monitor file system access to RabbitMQ log directories using auditd or similar tools
• Implement alerting on RabbitMQ API authentication from unexpected source IPs
• Review access control lists on log files and log aggregation systems
• Enable security monitoring on systems with access to centralized logging platforms

Monitoring Recommendations

• Configure file integrity monitoring on RabbitMQ log directories
• Implement network-based monitoring for RabbitMQ management API access patterns
• Audit user accounts with read access to RabbitMQ server file systems
• Review authentication logs for credential reuse or suspicious login patterns

How to Mitigate CVE-2025-50200

Immediate Actions Required

• Upgrade RabbitMQ to version 4.0.8 or later where this issue has been patched
• Rotate all credentials used for RabbitMQ HTTP API basic authentication
• Review and restrict file system permissions on RabbitMQ log directories
• Audit access to centralized logging systems that may contain RabbitMQ logs

Patch Information

Broadcom has released RabbitMQ version 4.0.8 which addresses this vulnerability by properly masking or excluding authorization headers from log output. Organizations should upgrade to this version as soon as possible. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Restrict log file access permissions to only essential administrative accounts
• Consider switching to alternative authentication methods such as certificate-based authentication (mTLS) that do not use basic auth headers
• Implement log rotation with secure deletion to minimize the exposure window of sensitive data
• Isolate RabbitMQ servers and limit network access to management APIs

# Restrict RabbitMQ log directory permissions
chmod 700 /var/log/rabbitmq
chown rabbitmq:rabbitmq /var/log/rabbitmq

# Verify current permissions
ls -la /var/log/rabbitmq/