CyberRota Analysis
AI-GeneratedMoquette, a lightweight Java MQTT broker, is vulnerable to improper handling of pattern-based ACL rules, allowing clients to manipulate their identity values to gain unauthorized cross-tenant access or disrupt session processing through a NullPointerException. This critical vulnerability, with a CVSS score of 9.6, poses significant risks to environments utilizing Moquette versions prior to 0.18.1. Organizations using this broker should prioritize upgrading to version 0.18.1 to mitigate these security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)