CVE-2024-10525
📋 TL;DR
This vulnerability allows a malicious MQTT broker to crash or potentially execute arbitrary code on clients using libmosquitto by sending a specially crafted SUBACK packet with no reason codes. It affects all clients using the mosquitto_sub and mosquitto_rr utilities from Eclipse Mosquitto versions 1.3.2 through 2.0.18. The vulnerability is triggered when the client processes the malicious packet in its on_subscribe callback.
💻 Affected Systems
- Eclipse Mosquitto
- libmosquitto
- mosquitto_sub client
- mosquitto_rr client
📦 What is this software?
Mosquitto by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on affected clients, allowing an attacker to take full control of the client system.
Likely Case
Client crash (denial of service) due to out-of-bounds memory access, disrupting MQTT communication.
If Mitigated
No impact if clients only connect to trusted brokers or if the vulnerability is patched.
🎯 Exploit Status
The vulnerability is in packet parsing logic, making exploitation straightforward once the packet format is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.19
Vendor Advisory: https://mosquitto.org/blog/2024/10/version-2-0-19-released/
Restart Required: Yes
Instructions:
1. Download Mosquitto 2.0.19 or later from mosquitto.org. 2. Stop all Mosquitto client processes. 3. Install the new version following platform-specific instructions. 4. Restart client processes.
🔧 Temporary Workarounds
Restrict broker connections
allConfigure clients to only connect to trusted, internal MQTT brokers.
Edit client configuration to use trusted broker addresses only.
🧯 If You Can't Patch
- Implement network segmentation to isolate MQTT clients from untrusted networks.
- Use application firewalls or intrusion prevention systems to block malformed SUBACK packets.
🔍 How to Verify
Check if Vulnerable:
Check if Mosquitto client version is between 1.3.2 and 2.0.18 inclusive.Check Version:
mosquitto_sub --version 2>&1 | head -1Verify Fix Applied:
Confirm version is 2.0.19 or higher and test client connectivity with a broker.📡 Detection & Monitoring
Log Indicators:
- Client crash logs
- Segmentation fault errors in system logs
- Unexpected disconnections from broker
Network Indicators:
- SUBACK packets with missing reason codes from brokers
- Abnormal MQTT traffic patterns
SIEM Query:
source="*mosquitto*" AND ("segmentation fault" OR "crash" OR "SIGSEGV")