RabbitMQ server versions 4.2.0 to 4.2.7 and 4.3.0 to 4.3.1 contain a cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the set_token_auth/2 function inserts a bearer token from the Authorization header or access_token cookie directly into OAuth bootstrap JavaScript without escaping, enabling execution of attacker-controlled JavaScript in the management UI's origin. This endpoint is accessible before authentication only if management.oauth_enabled is true. Exploitation via the cookie path requires the attacker to plant an access_token cookie on the management host. The vulnerability is resolved in versions 4.2.8 and 4.3.2.

An attacker able to supply a malicious bearer token or plant an access_token cookie on the management host can execute arbitrary JavaScript in the context of the RabbitMQ management UI. This could lead to actions such as session hijacking or other client-side attacks within the management interface. The vulnerability requires the management.oauth_enabled setting to be true and either control over the Authorization header or the ability to plant a cookie on the management host.

This vulnerability is fixed in rabbitmq-server versions 4.2.8 and 4.3.2. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated. If upgrading is not immediately possible, ensure that management.oauth_enabled is disabled to prevent exposure of the vulnerable endpoint.