Executive brief
Mosca is an open-source MQTT broker library used to enable real-time message publishing and subscription in Node.js applications. A flaw in how it processes message topics allows an attacker to send specially crafted input that triggers a denial-of-service condition, causing the broker to crash and disrupting all connected clients and their ability to send or receive messages.
Technical details
This vulnerability is a Regular Expression Denial of Service (REDoS) attack resulting from improper input validation (CWE-20, CWE-185) in topic processing. The flaw exists in how Mosca handles topic patterns; a maliciously crafted regular expression can cause catastrophic backtracking in the regex engine, consuming excessive CPU and memory until the broker process crashes. Attack requires network access to the MQTT broker with no authentication or privileges; no user interaction is needed. An attacker can trigger a denial of service by sending a single malicious topic message. The vulnerability affects all versions prior to 2.8.2, which contains the fix.
Affected products
- npm mosca < 2.8.2
Timeline
- 2018-08-31: disclosed
- 2018: patched: Fixed in version 2.8.2