EDR: Does the Support of Clear Text Authentication by AMQP Cause a Vulnerability in the Server?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Does the support of clear text authentication by AMQP cause a vulnerability in the EDR Server?

Environment

• EDR Server: 6.2.3 and Higher

Resolution

No. AMQP Clear Text Authentication is within the RabbitMQ Management UI, but not used by users in EDR. Additionally, the ManageFirewall setting that is present from v6.2.3 and higher helps secure the port that RabbitMQ is listening on. Credential authentication would still be required even if a person had access to the interface.

Additional Information

EDR Servers using a version that is lower than 6.2.3 will utilize ManageIptables as opposed to ManageFirewall.