Vulnerability GHSA-27gv-rfvv-22mv

Summary

An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session.

For standard PLAIN authentication, this state utilizes the PlainAuth struct, which defines both Username and Password as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core *Connection object can read and expose the raw credentials.

Attack Vector

An attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:

1. Configuration Dump: An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP *Connection object.
2. Reflective Access: The inspection engine uses Go's reflect package to walk the structural hierarchy, pulling the string value from Connection.Config.SASL.(*PlainAuth).Password.
3. Exfiltration: The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.