Eclipse Mosquitto Authentication Bypass Vulnerability - CVE-2018-12551
Summary
ALPINE-CVE-2018-12551: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. Affects mosquitto versions < 1.5.6-r0. Fixed in 1.5.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Mosquitto is an open-source message broker that implements the MQTT protocol, widely used for IoT applications. It facilitates communication between devices by allowing them to publish and subscribe to messages. The package is known for its lightweight design and ease of use, making it a popular choice for developers. However, certain versions of Mosquitto are vulnerable to a security flaw that affects its authentication mechanism when using password files.
Vulnerability Detail
The vulnerability arises from the handling of malformed data in the password file used for authentication in Eclipse Mosquitto versions 1.0 to 1.5.5. When configured to use a password file, any malformed entry is incorrectly treated as a valid username with no associated password. This allows unauthorized clients to bypass authentication by using the malformed username, potentially gaining access to the broker. Notably, a blank line in the password file can be interpreted as a valid empty username, further exacerbating the issue. Other security measures remain unaffected, but this flaw poses a significant risk to the integrity of the broker's access control.
How To Fix
Minimum fixed version
1.5.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade mosquittoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your password file does not contain any malformed entries or blank lines. Regularly validate the contents of the password file to maintain secure authentication.
Conclusion
The Eclipse Mosquitto authentication bypass vulnerability (CVE-2018-12551) poses a significant risk to users relying on password files for authentication. It is crucial to update to the patched version and maintain proper validation of password files to ensure secure access control. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mosquitto →
FAQ
Eclipse Mosquitto versions from 1.0 to 1.5.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
If you cannot update, ensure that your password file is free of malformed entries and consider implementing additional security measures to protect your broker.
No, other security measures in Mosquitto remain unaffected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mosquitto.
