MISC: Mosquitto MQTT Client ID ACL Bypass
This signature detects attempts to exploit a known vulnerability against Mosquitto MQTT. A successful attack can lead to security bypass.
Extended Description
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
Affected Products
Eclipse mosquitto
Short Name
MISC:MQTT-CLNT-BYPASS
Severity
Minor
Recommended
False
Recommended Action
Drop
Category
MISC
Keywords
ACL Bypass CVE-2017-7650 Client ID MQTT Mosquitto bid:98741
Release Date
11/14/2019
Supported Platforms
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vsrx-19.2
srx-19.3
Sigpack Version
3590
False Positive
Unknown
Vendors
Eclipse
Debian
CVSS Score
4.0