Executive brief
MQTT.js, a popular Node.js MQTT client library, fails to properly handle malicious PUBLISH packets received from an MQTT server, allowing a compromised or untrusted server to trigger a denial of service condition. An attacker controlling the server can flood the client with crafted PUBLISH packets, causing the client application to crash and become unavailable.
Technical details
The vulnerability exists in MQTT.js versions 2.0.0 through 2.14.x due to improper handling of PUBLISH packets returned by the server, specifically in the packet processing logic. The root cause is a stack overflow condition triggered when a single TCP frame contains too many PUBLISH packets, as demonstrated in the proof of concept that generates over 1000 messages with incrementing message IDs. The attack requires network connectivity to an MQTT server and the ability to send malicious PUBLISH packets to the connected client (typically an attacker-controlled or compromised server). An attacker can crash the client application, resulting in denial of service. The fix was released in version 2.15.0, which properly bounds the number of PUBLISH packets processed per TCP frame.
Affected products
- MQTT.js MQTT.js 2.0.0 to 2.14.x
Timeline
- 2017-12-28: disclosed
- 2017-12-28: patched: Fixed in version 2.15.0