Eclipse Mosquitto ACL Misconfiguration Vulnerability - CVE-2018-12550
Summary
ALPINE-CVE-2018-12550: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has bee... Affects mosquitto versions < 1.5.6-r0. Fixed in 1.5.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Mosquitto is an open-source message broker that implements the MQTT protocol, widely used for IoT applications. It enables devices to communicate with each other efficiently. The package is known for its lightweight design and ease of use, making it a popular choice for developers. However, it has a vulnerability related to Access Control Lists (ACL) that can lead to unintended access permissions.
Vulnerability Detail
The vulnerability, identified as CVE-2018-12550, arises when Eclipse Mosquitto versions 1.0 to 1.5.5 are configured to use an ACL file that is either empty or contains only comments or blank lines. In such cases, Mosquitto defaults to an allow policy, granting all access instead of denying it. This misconfiguration can lead to unauthorized access to sensitive data or control over the message broker, posing significant security risks.
How To Fix
Minimum fixed version
1.5.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade mosquittoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the ACL file is not empty. You can add specific rules to the ACL file to restrict access appropriately. For example, you can add the following line to deny all access: topic deny #.
Conclusion
CVE-2018-12550 is a critical vulnerability in Eclipse Mosquitto that can lead to unauthorized access due to misconfigured ACL files. It is essential to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for mosquitto →
FAQ
CVE-2018-12550 is a vulnerability in Eclipse Mosquitto that allows unauthorized access when an empty or improperly configured ACL file is used.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to the Mosquitto broker, allowing attackers to read or send messages without permission.
You can update your Mosquitto package using the command: apk add mosquitto@<version>, replacing <version> with the appropriate patched version.
The CVSS score of CVE-2018-12550 is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mosquitto.
