A critical information disclosure vulnerability in RabbitMQ allows unauthenticated attackers to retrieve OAuth2 client secrets, posing a high risk of unauthorized system access.

This vulnerability is an exposure of sensitive information (CWE-200) occurring when the RabbitMQ Management UI is configured with OAuth2. An unauthenticated endpoint at /js/oidc-oauth/bootstrap.js inadvertently serves the configured OAuth2 client secret to any user who can reach the management interface.

The exposure of OAuth2 client secrets allows an attacker to complete the authorization code flow, leading to potential token theft and full client impersonation within the messaging environment. Given the CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and integrity of RabbitMQ deployments. Unauthorized access to the management layer can facilitate broader system compromise and unauthorized data transit.

Immediate Action: Upgrade to RabbitMQ version 4.3.3 or 4.2.9 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review access logs for any unauthorized requests to the /js/oidc-oauth/bootstrap.js endpoint and monitor for anomalous authentication behavior originating from unexpected clients.

Compensating Controls: If an immediate upgrade is not feasible, restrict network access to the RabbitMQ Management UI using firewall rules or a VPN to ensure only authorized personnel can reach the interface.

Public Exploit Available: Unknown.

This vulnerability presents a significant security risk by exposing core authentication secrets that govern access to the RabbitMQ platform. Administrators must prioritize updating to the patched versions (4.3.3 or 4.2.9) to eliminate the exposure of the OAuth2 client secret. Given the potential for impersonation and unauthorized access, delaying this update significantly increases the attack surface of the messaging infrastructure.