Executive brief
aedes is a Node.js MQTT broker library used to build message-oriented applications. Versions before 0.35.1 bypass their own authorization rules when a client sets a Last Will message, allowing authenticated users to publish messages to restricted topics that they should not have access to. This could result in unauthorized message publication, data exposure, or system compromise depending on the message contents and topic restrictions.
Technical details
The vulnerability is an authorization bypass in aedes's Last Will functionality. When an MQTT client sets a Last Will message (a message that is automatically published by the broker upon the client's unexpected disconnection), the broker fails to validate whether the client has permission to publish to the target topic. An authenticated client can exploit this by setting a Last Will message to a restricted topic they do not have publish access to; the message will be delivered after disconnection despite the authorization failure. The attack requires valid client authentication but no user interaction. The vulnerability was fixed in commit ffbc170 by implementing proper authorization checks before accepting Last Will messages. Affected versions include all releases from 0.1.0 up to and including 0.35.0.
Affected products
- npm aedes 0.1.0 to 0.35.0
Timeline
- 2021-02-23: disclosed
- 0.35.1: patched