CVE-2019-5432

Root

Cause

The vulnerability resides in the mqtt-packet module's decode function for MQTT Subscribe packets. When the module receives a specifically malformed Subscribe packet, it triggers a crash, likely due to improper handling of malformed data or a null pointer dereference. This affects all versions before 3.5.1, 4.0.0 through 4.1.3, 5.0.0 through 5.6.1, and 6.0.0 through 6.1.2 [1].

Exploitation

An attacker can exploit this by sending a single crafted MQTT Subscribe packet to a broker using a vulnerable version of the mqtt-packet module. No authentication or special network position is required beyond the ability to send MQTT packets to the broker. The crash occurs during packet decoding, before any authorization checks [1].

Impact

Successful exploitation results in a denial of service (DoS) as the broker process crashes, disrupting MQTT messaging services. Since the crash occurs at the decoding stage, it can be triggered before any authentication or authorization checks are performed, widening the attack surface [1].

Mitigation

Users should update the mqtt-packet module to version 3.5.1, 4.1.4, 5.6.2, or 6.1.3 or later, as these versions contain the fix for this vulnerability. No workarounds are available; the only remediation is to apply the patch provided by the maintainers [1].