EDR: Does the Support of Clear Text Authentication by AMQP Cause a Vulnerability in the Server?
book
Article ID: 287578
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Does the support of clear text authentication by AMQP cause a vulnerability in the EDR Server?
Environment
EDR Server: 6.2.3 and Higher
Resolution
No. AMQP Clear Text Authentication is within the RabbitMQ Management UI, but not used by users in EDR. Additionally, the ManageFirewall setting that is present from v6.2.3 and higher helps secure the port that RabbitMQ is listening on. Credential authentication would still be required even if a person had access to the interface.
Additional Information
EDR Servers using a version that is lower than 6.2.3 will utilize ManageIptables as opposed to ManageFirewall.