RockteMQ-AI commented on issue #4007: URL: https://github.com/apache/rocketmq-dashboard/issues/4007#issuecomment-5561122366
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The reported security issue has been verified against the described code paths. **Root Cause:** `MessageServiceImpl.java:359-362` retrieves a stored query result by its `id` without verifying that the requesting user owns that result. Any authenticated user who knows or guesses a result UUID can call `GET /api/rocketmq/message/queryResult?id=<uuid>` and read another user's query parameters, including the `topic`, `begin`, `end`, `key`, `msgId`, and SQL filter that may reveal operational patterns. **Impact:** Information disclosure — a lower-privileged or read-only user can enumerate stored query parameters belonging to other users. While the stored data does not include message bodies, the topic names, time ranges, and filter expressions can reveal operational patterns and monitoring targets. **Severity:** Medium — authenticated information disclosure. No message body or credential exposure, but violates the principle of least privilege on a multi-tenant dashboard. **Linked PR:** #4003 — Adding an ownership check (`record.getCreateUser().equals(currentUser)`) before returning the stored result is the correct fix. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
