In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client
    id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do
    have the rights to. The same issue may be present in third party authentication/access control plugins for
    Mosquitto. (CVE-2017-7650)

Fix CVE-2017-7650 (rhbz#1456507)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-7650: Pattern based ACLs can be bypassed by clients that set their username/client id to &lsquo;#&rsquo; or &lsquo;+&rsquo;. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third-party authentication/access control plugins for Mosquitto.

The vulnerability only comes into effect where pattern based ACLs are in use, or potentially where third-party plugins are in use.

For Debian 7 'Wheezy', these problems have been fixed in version 0.15-2+deb7u1.

We recommend that you upgrade your mosquitto packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that pattern-based ACLs in the Mosquitto MQTT broker could be bypassed.

ID	Name	Product	Family	Severity
424158	Alpine: multiple mosquitto packages: security update to 1.4.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424158	Alpine: multiple mosquitto packages: security update to 1.4.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
101636	Fedora 26 : mosquitto (2017-59f85fef2c)	Nessus	Fedora Local Security Checks	medium
100742	Fedora 24 : mosquitto (2017-486a536b62)	Nessus	Fedora Local Security Checks	medium
100734	Fedora 25 : mosquitto (2017-c2113aacd2)	Nessus	Fedora Local Security Checks	medium
100513	Debian DLA-961-1 : mosquitto security update	Nessus	Debian Local Security Checks	medium
100484	Debian DSA-3865-1 : mosquitto - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-7650

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium