Moquette Broker CVE-2024-45058: Will Message ACL Bypass and CC6 Deserialization RCE Analysis

Summary of Vulnerability Key Information Vulnerability Overview Vulnerability Name: Missing Authorization in CVE ID: CVE-2024-45058 Severity: High (CVSS v3.1 Score 7.5/10) Root Cause: In (v0.18.0), the method does not invoke to perform permission validation when publishing Will messages. This allows an attacker to bypass ACL write restrictions via the Will Topic in the CONNECT packet. Scope of Impact Affected Versions: Fixed Versions: (Note: The page lists 0.18.0 as a fixed version, but the root cause code is annotated as v0.18.0, creating a version labeling contradiction; the official release notes should be treated as authoritative). Affected Scenarios: MQTT Broker deployments with ACL enabled. An attacker can trigger Will message publishing by abruptly disconnecting via TCP RST, bypassing ACL write restrictions to achieve unauthorized writes. When combined with the CCE deserialization chain, this can further lead to Remote Code Execution (RCE). Remediation Upgrade to the fixed version or higher. Temporary Mitigation: Set in and enable ACL configuration ( ) to restrict anonymous connections and topic write permissions. POC / Exploit Code 1. Python Verification Script (No Dependencies) 2. Java Attacker-Side (CC6 Deserialization Chain) 3. Java Victim-Side (IoT Device Simulation) 4. Configuration Example Impact Assessment Attack Vector: Network-reachable MQTT Broker (TCP 1883) Required Privileges: None (anonymous connections are sufficient) User Interaction: No user interaction required Impact: High impact on Integrity (ACL write protection is completely bypassed), no impact on Availability, no impact on Confidentiality.

Goal Reached Thanks to every supporter — we hit 100%!

Moquette Broker CVE-2024-45058: Will Message ACL Bypass and CC6 Deserialization RCE Analysis

More from this source