RabbitMQ server versions from 3.13.0 up to but not including 3.13.18, 4.0.0 up to 4.0.23, 4.1.0 up to 4.1.14, 4.2.0 up to 4.2.9, and 4.3.0 up to 4.3.3 contain a stored cross-site scripting vulnerability (CWE-79) in the stream-management UI. The vulnerability occurs because the TLS peer-certificate DN fields (peercertsubject and peercertissuer) are rendered using raw template tags without proper HTML escaping, allowing injection of malicious HTML/JavaScript. The RFC4514 backslash-escaping used in the DN is insufficient to prevent HTML injection. Exploitation requires a non-default configuration: a stream TLS listener with peer verification enabled and an attacker-controlled certificate signed by a trusted CA. When an operator views the stream-connection details, the malicious script executes in their browser context. The vulnerability is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

Successful exploitation allows an attacker who can present a malicious TLS certificate trusted by the RabbitMQ server to execute arbitrary script code in the context of an operator's browser viewing the stream-management UI. This can lead to session hijacking, credential theft, or other actions permitted by the operator's privileges. The attack requires the attacker to have a certificate signed by a CA trusted by the server and the server to be configured with a TLS listener using peer verification, which is a non-default configuration. There is no indication of known exploits in the wild.

Upgrade RabbitMQ server to one of the fixed versions: 3.13.18, 4.0.23, 4.1.14, 4.2.9, or 4.3.3. This vulnerability is addressed in these releases by properly escaping TLS peer-certificate DN fields in the stream-management UI. If upgrading is not immediately possible, consider disabling the stream TLS listener with peer verification or restrict access to the stream-management UI to trusted operators only. Patch status is confirmed fixed in the stated versions.