Critical MQTT Packet Vulnerability in node-mqtt-packet: Crash Risk from Malformed Subscribe Packets
Summary
CVE-2019-5432: A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding. Affects node-mqtt-packet across 2 version ranges.
< 6.0.0-2
< 483b6d85ca493ad213886e784a3e092df51ed559
Fixed in 6.0.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-mqtt-packet package is a widely used library for handling MQTT (Message Queuing Telemetry Transport) packets in Node.js applications. MQTT is a lightweight messaging protocol designed for low-bandwidth, high-latency networks, making it ideal for IoT devices. The library facilitates the encoding and decoding of MQTT packets, ensuring seamless communication between clients and brokers. However, certain versions of this package are vulnerable to a specific type of attack that can lead to crashes in MQTT brokers.
Vulnerability Detail
CVE-2019-5432 is a vulnerability that arises from the handling of malformed MQTT Subscribe packets by the mqtt-packet module. Versions prior to 3.5.1, as well as 4.0.0 to 4.1.3, 5.0.0 to 5.6.1, and 6.0.0 to 6.1.2, are affected. When a broker receives a specifically crafted Subscribe packet, it can cause the broker to crash, leading to potential service disruptions. This vulnerability is critical, with a CVSS score of 7.5, indicating a high severity level. Attackers can exploit this flaw to disrupt services, impacting any applications relying on MQTT for communication.
How To Fix
Minimum fixed version
6.0.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mqtt-packetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation on the MQTT packets received by your broker. This can help mitigate the risk of processing malformed packets. However, this is not a complete solution and should only be a temporary measure until the package is updated.
Conclusion
CVE-2019-5432 poses a significant risk to applications using vulnerable versions of the node-mqtt-packet library. It is crucial to update to the latest version to prevent potential service disruptions caused by malformed MQTT Subscribe packets. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for node-mqtt-packet →
FAQ
CVE-2019-5432 is a vulnerability in the node-mqtt-packet library that allows attackers to crash MQTT brokers by sending malformed Subscribe packets.
Affected versions include those prior to 3.5.1, as well as 4.0.0 to 4.1.3, 5.0.0 to 5.6.1, and 6.0.0 to 6.1.2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation on the MQTT packets to mitigate the risk temporarily until you can perform the update.
The CVSS score of CVE-2019-5432 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-mqtt-packet.
