NanoMQ MQTT Broker WebSocket Denial-of-Service Vulnerability via Malformed Remaining Length

A denial-of-service vulnerability has been identified in NanoMQ MQTT Broker versions prior to 0.24.8. The issue arises in the MQTT-over-WebSocket transport, where an attacker can cause a crash by sending a packet with a large Remaining Length in the header, but a shorter payload. This discrepancy leads to an out-of-bounds read, causing a process crash. The vulnerability can be exploited remotely through the WebSocket listener.

Impact

Exploitation of this vulnerability leads to a process crash, causing a denial-of-service condition on the WebSocket MQTT listener.

Reproduction

The vulnerability can be reproduced by sending a malformed PUBLISH packet over a WebSocket connection, after establishing a valid MQTT CONNECT. The PUBLISH packet should have a Remaining Length of 4096 bytes, but only include 3 bytes of actual payload, creating the out-of-bounds condition.

Remediation

Users can upgrade to NanoMQ version 0.24.8 or later to address this vulnerability.