CVE-2021-43799

CVE-2021-43799 affects Zulip Server versions prior to 4.9, where a critical vulnerability exists in the initial installation of RabbitMQ. The issue stems from RabbitMQ's distribution port (25672) being exposed and protected by a weak, brute-forceable "cookie" with approximately 20 bits of entropy. A remote attacker can exploit this to achieve arbitrary code execution as the rabbitmq user and access all message traffic. This vulnerability carries a critical CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low complexity and leads to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.