Listen to this Post
Moquette exposes an MQTT broker to untrusted clients, anonymous by default.
Every byte, including pre-authentication CONNECT, is untrusted.
The audited module is broker/ at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef.
The issue class is authorization/ACL bypass, denial of service, and cross-session integrity.
It is not memory corruption or RCE in this memory-safe JVM.
Pattern ACL rules substitute clientId and username into topic filters.
AuthorizationsCollector.canDoOperation replaces %c with client and %u with username.
The substituted topic is wildcard-matched with Topic.match.
clientId is not validated for MQTT wildcard characters + and at CONNECT.
A client can connect with clientId +.
A configured rule such as sensor/%c/ becomes sensor/+/.
The filter then matches sibling tenants under sensor/.
This grants cross-tenant read and write when pattern ACLs are used.
A clientId produces invalid filter sensor//.
Null tokens reach Topic.match and throw NullPointerException at Topic.java:173.
SessionEventLoop catches only InterruptedException.
It is never restarted by SessionEventLoopGroup.
Any uncaught exception wedges every co-located client.
Malformed $share/grp SUBSCRIBE reaches SharedSubscriptionUtils.extractShareName.
That throws StringIndexOutOfBoundsException.
Deeply nested topics recurse through CTrie and can throw StackOverflowError.
Unbounded subscriptions, retained, in-flight, topic-alias, and interceptor queues allow OOM.
BrokerInterceptor uses an unbounded queue.
Durable stores can be exhausted on disk.
Will-message authorization bypass publishes Last-Will via PostOffice.publishWill.
It skips canWrite and reserved-topic checks used for normal PUBLISH.
H2PersistentQueue opens queue_ + clientId and queue_ + clientId + _meta.
Client id sensor_meta collides with victim sensor metadata map.
That corrupts head/tail and cross-session durable state.
Authenticator/authorizator class load failure can fail open to PermitAll/AcceptAll.
PoCs are source-only on JDK 17: PoCPatternAcl, PoCSharedSubCrash, PoCMapCollision.
Impact includes cross-tenant eavesdropping, injection, whole-broker DoS, unauthorized Will publishes, and durable corruption.
DailyCVE Form:
Platform: Moquette
Version: da7f719a6bab9829d520b5838e13ea7b1f9be3ef
Vulnerability: ACL bypass DoS
Severity: Critical
date: Not provided
Prediction: Unknown
(end of form)
What Undercode Say:
Analytics:
git clone https://github.com/moquette-io/moquette.git cd moquette git checkout da7f719a6bab9829d520b5838e13ea7b1f9be3ef grep -R "canDoOperation" broker/ grep -R "processConnect" broker/ grep -R "extractShareName" broker/ grep -R "publishWill" broker/ grep -R "H2PersistentQueue" broker/ javac -d out PoCPatternAcl.java java -cp out PoCPatternAcl javac -d out PoCSharedSubCrash.java java -cp out PoCSharedSubCrash javac -d out PoCMapCollision.java java -cp out PoCMapCollision
Topic substitutedTopic = new Topic(auth.topic.toString().replace("%c", client).replace("%u", username));
if (topic.match(substitutedTopic)) return true;
SessionEventLoop catches only InterruptedException
SharedSubscriptionUtils.extractShareName("$share/grp") -> StringIndexOutOfBoundsException
Topic.match NPE at Topic.java:173
PostOffice.publishWill without canWrite/reserved-topic checks
H2PersistentQueue queue_ + clientId and queue_ + clientId + _meta
Exploit: (Educational Purposes!)
// clientId "+" clientId = "+"; // pattern ACL sensor/%c/ becomes sensor/+/ // cross-tenant read AND write
// clientId "" clientId = ""; // invalid filter sensor// -> null tokens -> Topic.match NPE at Topic.java:173
// malformed $share/grp SUBSCRIBE
extractShareName("$share/grp");
// StringIndexOutOfBoundsException
// deeply nested topic // CTrie recursion -> StackOverflowError
// Will-message authorization bypass PostOffice.publishWill(...); // no canWrite/reserved-topic checks
// cross-session durable corruption // clientId sensor_meta collides with victim sensor metadata map // corrupts head/tail
Protection: from this CVE
- Reject clientId/username containing +/ at CONNECT.
- Expand %c/%u as literal tokens.
- Harden SessionEventLoop: catch Throwable and restart supervision.
- Validate $share filters.
- Apply authorization to Will publishes like normal PUBLISH.
- Add resource caps: connections, queues, retained, aliases, interceptor queue.
- Add bounded session expiry.
- Separate H2 namespaces.
- Fail closed on auth-class load failure.
Impact:
Cross-tenant eavesdropping and injection.
Whole-broker DoS.
Unauthorized Will publishes.
Cross-session durable corruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
