CVE-2021-34432
📋 TL;DR
This vulnerability allows remote attackers to crash Eclipse Mosquitto MQTT broker servers by sending a specially crafted PUBLISH packet with zero-length topic. All systems running vulnerable versions of Mosquitto are affected, potentially causing denial of service.
💻 Affected Systems
- Eclipse Mosquitto
📦 What is this software?
Mosquitto by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of the MQTT broker, disrupting all IoT/MQTT communications and potentially affecting downstream systems that depend on message delivery.
Likely Case
Service disruption requiring manual restart of the Mosquitto broker, causing temporary loss of message delivery and connectivity for connected clients.
If Mitigated
Minimal impact if proper network segmentation and monitoring are in place, with quick detection and restart capabilities.
🎯 Exploit Status
Exploitation requires sending a single malformed MQTT packet, making it trivial to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.8 and later
Vendor Advisory: https://mosquitto.org/blog/2021/06/version-2-0-8-released/
Restart Required: Yes
Instructions:
1. Download Mosquitto 2.0.8 or later from official sources. 2. Stop the Mosquitto service. 3. Install the updated version. 4. Restart the Mosquitto service.
🔧 Temporary Workarounds
Network Filtering
allUse network firewalls or application gateways to filter MQTT traffic and block malformed packets.
Load Balancer/Proxy Protection
allConfigure load balancers or reverse proxies to validate MQTT packets before forwarding to Mosquitto.
🧯 If You Can't Patch
- Implement network segmentation to isolate Mosquitto brokers from untrusted networks
- Deploy monitoring and automated restart scripts to detect and recover from crashes
🔍 How to Verify
Check if Vulnerable:
Check Mosquitto version with 'mosquitto -v' or examine package version. If version is 2.0.7 or earlier, system is vulnerable.Check Version:
mosquitto -vVerify Fix Applied:
After patching, verify version is 2.0.8 or later and test with a controlled malformed packet (if safe testing environment available).📡 Detection & Monitoring
Log Indicators:
- Mosquitto process crashes
- Unexpected termination logs
- Connection errors from clients after broker restart
Network Indicators:
- MQTT PUBLISH packets with topic length field set to 0
- Sudden drop in MQTT traffic followed by service restart
SIEM Query:
source="mosquitto.log" AND ("crash" OR "segmentation fault" OR "terminated unexpectedly")