Executive brief
Eclipse Ditto is an open-source IoT platform that manages digital twins of devices. A flaw in its connectivity service allows attackers publishing messages to a configured connection to inject malicious JSON code that can override access-control policies on newly created digital twins, potentially granting themselves full read/write access and locking out legitimate administrators. Exploitation requires the connection to use a non-default mapper configuration that reflects attacker-controllable message headers.
Technical details
The ImplicitThingCreationMessageMapper in Eclipse Ditto's connectivity service performs unsafe JSON string interpolation. It substitutes placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON template as raw, unescaped strings, then parses the result. Because no JSON escaping is applied and the placeholder engine lacks context awareness, a header value containing a double-quote character can break out of its string context and inject arbitrary JSON structure, including an inline _policy object. Attack surface includes connections using the non-default ImplicitThingCreation mapper with templates that reflect attacker-controllable headers (MQTT 5 user properties, AMQP 1.0 application properties, Kafka record headers, etc.). Successful exploitation allows policy override, granting full access to the digital twin. Patch availability and details are not specified in the advisory.
Affected products
- Eclipse Ditto [1.3.0, 3.9.6]
Timeline
- 2026-09-02: disclosed