Sensitive Data Exposure in Mosquitto: World Readable Persistence File
Summary
ALPINE-CVE-2017-9868: In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information. Affects mosquitto versions < 1.4.13-r0. Fixed in 1.4.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mosquitto is an open-source message broker that implements the MQTT protocol, widely used for IoT applications and real-time messaging. It allows devices to communicate with each other efficiently and is known for its lightweight design and ease of use. However, a vulnerability has been identified in versions up to 1.4.12, where the persistence file (mosquitto.db) is world-readable, potentially exposing sensitive MQTT topic information to unauthorized local users.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9868, arises from improper file permissions on the mosquitto.db file, which stores persistent data for the Mosquitto broker. This flaw allows any local user to read the contents of the file, leading to the exposure of sensitive information such as MQTT topics and messages. The ramifications of this vulnerability can be significant, especially in environments where sensitive data is transmitted via MQTT, as it could lead to data leaks and unauthorized access to information.
How To Fix
Minimum fixed version
1.4.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade mosquittoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can change the permissions of the mosquitto.db file to restrict access. Use the following command to set the file permissions to be readable only by the owner: 'chmod 600 /path/to/mosquitto.db'. This will prevent other local users from accessing the sensitive data until the package is updated.
Conclusion
The vulnerability CVE-2017-9868 in Mosquitto poses a significant risk due to the world-readable nature of the persistence file, allowing unauthorized local access to sensitive data. It is crucial to update to the patched version or implement temporary workarounds to protect sensitive information.
See every vulnerability recorded for mosquitto →
FAQ
CVE-2017-9868 is a vulnerability in Mosquitto that allows local users to read sensitive information from the world-readable persistence file, mosquitto.db.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The risks include unauthorized access to sensitive MQTT topics and messages, which could lead to data leaks and potential exploitation of the information.
Yes, a patch is available in version 1.4.13-r0 and later of the Mosquitto package. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, you should restrict access to the mosquitto.db file using the command 'chmod 600 /path/to/mosquitto.db' to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for mosquitto.
