Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 23 February 2021.
- Which products and versions are affected?
- aedes (npm) 0.1.0 to 0.35.0.
- Is there a fix for This vulnerability?
- A patch was published on 0.35.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run aedes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in aedes's Last Will functionality. When an MQTT client sets a Last Will message (a message that is automatically published by the broker upon the client's unexpected disconnection), the broker fails to validate whether the client has permission to publish to the target topic. An authenticated client can exploit this by setting a Last Will message to a restricted topic they do not have publish access to; the message will be delivered after disconnection despite the authorization failure. The attack requires valid client authentication but no user interaction. The vulnerability was fixed in commit ffbc170 by implementing proper authorization checks before accepting Last Will messages. Affected versions include all releases from 0.1.0 up to and including 0.35.0.
Affected products
- npm aedes 0.1.0 to 0.35.0
Timeline
- 2021-02-23: disclosed
- 0.35.1: patched