Does CVE-2025-50200 (RabbitMQ HTTP/s API vulnerability) affect OnlyOffice Document Server 7.5.x?

[Aaditya-Rane]

Question

Does the RabbitMQ vulnerability CVE-2025-50200 (GHSA-gh3x-4x42-fvq8) affect OnlyOffice Document Server 7.5.x when using RabbitMQ 3.13.7?

My Setup

• OnlyOffice Document Server: 7.5.x (Windows installation)
• RabbitMQ: 3.13.7 (Windows)
• RabbitMQ Management Plugin: Disabled (port 15672 not listening)
• Connection: Document Server connects to RabbitMQ using AMQP protocol (port 5672)

Vulnerability Details

CVE-2025-50200 affects RabbitMQ versions ≤ 3.13.7. The vulnerability allows logging of Basic Auth headers (with base64-encoded credentials) in plaintext when HTTP/HTTPS management API endpoints (port 15672) are used and errors occur.

Patched versions: RabbitMQ ≥ 4.0.8, ≥ 3.13.8

Reference: GHSA-gh3x-4x42-fvq8

My Understanding (Please Confirm)

Based on my research:

1. OnlyOffice Document Server uses AMQP protocol (port 5672) to communicate with RabbitMQ for message queuing
2. OnlyOffice does NOT use HTTP management API endpoints (port 15672) for messaging operations
3. The RABBITMQ_PASSWORD configuration is used for AMQP authentication, not HTTP Basic Auth
4. The vulnerability specifically affects HTTP/HTTPS endpoints (port 15672), not AMQP protocol (port 5672)

Questions

1. Does OnlyOffice Document Server 7.5.x use any HTTP/HTTPS endpoints to communicate with RabbitMQ, or does it exclusively use AMQP protocol (port 5672)?

2. If OnlyOffice only uses AMQP and the management plugin is disabled, is the risk from CVE-2025-50200 minimal/non-existent since the vulnerable HTTP endpoints are not in use?

3. Should I upgrade RabbitMQ to 4.0.8+ for security, or is staying on 3.13.7 acceptable given that HTTP endpoints are not used?

4. Are there any scenarios where OnlyOffice Document Server might use RabbitMQ's HTTP management API endpoints that I should be aware of?

Additional Context

• RabbitMQ management plugin is disabled in my setup
• OnlyOffice configuration uses RABBITMQ_PASSWORD for AMQP authentication
• Port 5672 (AMQP) is listening and in use
• Port 15672 (HTTP management API) is not listening

Thank you for your help and clarification!

[igwyd]

Hello @Aaditya-Rane sorry for the late answer. Your understanding is correct.
ONLYOFFICE Docs communicates with RabbitMQ via the AMQP protocol on port 5672 and does not rely on RabbitMQ’s HTTP Management API (port 15672) for its normal messaging operations.