GHSA-5f42-97gr-vfhq: Critical severity maven/io.moquette:moquette-broker vulnerability
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.
What a connecting client can do
1. (Critical) Bypass pattern-based ACLs across tenants. In AuthorizationsCollector.canDoOperation (AuthorizationsCollector.java:116-131, esp. line 123) the clientId/username is substituted raw into a pattern ACL rule and then wildcard-matched, and the clientId is never validated for MQTT wildcard characters +/# at CONNECT (MQTTConnection.processConnect):
Topic substitutedTopic = new Topic(auth.topic.toString().replace("%c", client).replace("%u", username)); if (topic.match(substitutedTopic)) return true;
A client that connects with clientId + turns sensor/%c/# into the filter sensor/+/#, gaining cross-tenant read AND write. (Precondition: pattern ACL rules configured — a common multi-tenant setup.)
2. (High) Crash the whole broker. SessionEventLoop (SessionEventLoop.java:40-54) catches only InterruptedException and is never restarted (SessionEventLoopGroup), so any uncaught exception on it wedges every co-located client. Trivially reachable inputs: malformed $share/grp SUBSCRIBE (SharedSubscriptionUtils.extractShareName -> StringIndexOutOfBoundsException), deeply nested topic (CTrie recursion -> StackOverflowError), and ACL NPE below. Unbounded subscriptions / retained / in-flight / topic-alias / interceptor state (BrokerInterceptor uses an unbounded queue) also allow OOM; durable stores allow disk exhaustion.
3. (High) NPE in ACL sink on clientId # (invalid filter sensor/#/# -> null tokens -> Topic.match NPE at Topic.java:173).
4. (High) Will-message authorization bypass. Last-Will topic is published (PostOffice.publishWill) without canWrite/reserved-topic checks used for normal PUBLISH.
5. (Medium) Cross-session durable corruption. H2PersistentQueue opens queue"+clientId and queue"+clientId+"meta; client id sensormeta collides with victim sensor metadata map -> corrupts head/tail.
6. (Medium) Fail-open if authenticator/authorizator class fails to load -> PermitAll/AcceptAll (Server.java:483-531).
Proof of concept
Source-only, no network; PoCs run on JDK 17: - PoCPatternAcl — clientId + gains cross-tenant read/write; clientId # triggers NPE - PoCSharedSubCrash — extractShareName("$share/grp") throws StringIndexOutOfBoundsException - PoCMapCollision — H2 MVStore collision overwrites victim metadata pointer
Impact
Cross-tenant eavesdropping and injection, whole-broker DoS, unauthorized Will publishes, and cross-session durable corruption.
Remediation
1. Reject clientId/username containing +/# (and / if structural) at CONNECT; expand %c/%u as literal tokens. 2. Harden SessionEventLoop (catch Throwable + restart supervision) and validate $share filters. 3. Apply authorization to Will publishes like normal PUBLISH. 4. Add resource caps (connections, queues, retained, aliases, interceptor queue) + bounded session expiry. 5. Separate H2 namespaces and fail closed on auth-class load failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.moquette:moquette-brokerto a version that resolves this vulnerability.Fixed in 0.18.1 - Compensating control
At CONNECT, reject clientId and username values containing MQTT wildcard characters + or #, and reject / when it is structurally significant; expand %c and %u as literal tokens in pattern ACL rules.
- Compensating control
Apply authorization to Last-Will publishes through the same canWrite and reserved-topic checks used for normal PUBLISH operations.
- Compensating control
Harden SessionEventLoop by catching Throwable, validating malformed $share filters and other subscription inputs, and adding restart supervision so an uncaught exception cannot wedge co-located clients.
- Compensating control
Use separate H2 namespaces for client queues and metadata, and fail closed when the authenticator or authorizator class cannot be loaded instead of falling back to PermitAll or AcceptAll.
- Compensating control
Add resource caps for connections, queues, retained messages, topic aliases, and interceptor-queue state, and use bounded session expiry to limit memory and disk exhaustion.
Event History
Frequently Asked Questions
Are deployments using the default broker configuration exposed to untrusted clients?
Yes. The broker is described as allowing anonymous MQTT clients by default, so data from connecting clients, including pre-authentication traffic, must be treated as untrusted.
What configuration is required for the cross-tenant authorization bypass?
The bypass requires pattern-based ACL rules that substitute the client ID or username, such as rules using %c or %u. A client ID containing MQTT wildcard characters such as + or # can alter the substituted topic filter and obtain cross-tenant read and write access.
Does this issue provide remote code execution?
No remote code execution is claimed. The stated impact ceiling for this JVM-based broker is authorization or ACL bypass, denial of service, and cross-session integrity effects.