CVE-2023-5632
📋 TL;DR
This vulnerability in Eclipse Mosquitto allows denial-of-service attacks by establishing connections without sending data, causing excessive CPU consumption through EPOLLOUT events. It affects all users running Mosquitto versions up to and including 2.0.5. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Eclipse Mosquitto
📦 What is this software?
Mosquitto by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, preventing legitimate MQTT clients from connecting or communicating.
Likely Case
Degraded performance and intermittent service disruptions as CPU resources are consumed by malicious connections.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Exploitation requires only establishing TCP connections without sending MQTT data, making it trivial to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.6
Vendor Advisory: https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d
Restart Required: Yes
Instructions:
1. Download Mosquitto 2.0.6 or later from official sources. 2. Stop the Mosquitto service. 3. Install the new version. 4. Restart the Mosquitto service.
🔧 Temporary Workarounds
Connection Rate Limiting
linuxImplement network-level rate limiting to restrict the number of new connections per second.
iptables -A INPUT -p tcp --dport 1883 -m state --state NEW -m limit --limit 10/second --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -m state --state NEW -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate Mosquitto instances from untrusted networks
- Deploy Web Application Firewall (WAF) or network firewall rules to detect and block connection flooding patterns
🔍 How to Verify
Check if Vulnerable:
Check Mosquitto version: if version is 2.0.5 or earlier, the system is vulnerable.Check Version:
mosquitto --versionVerify Fix Applied:
Verify Mosquitto version is 2.0.6 or later and monitor CPU usage during connection attempts.📡 Detection & Monitoring
Log Indicators:
- High rate of new connections without subsequent MQTT packets
- Unusually high CPU usage by mosquitto process
Network Indicators:
- Multiple TCP connections to port 1883/8883 with no data exchange
- Connection attempts from single IP addresses at high frequency
SIEM Query:
source="mosquitto.log" AND "new connection" | stats count by src_ip | where count > 100