GHSA-x866-xp2g-cx8v

Описание

RabbitMQ MQTT Topic Permission Authorization Bypass

Summary

RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization.

For instance, a user with client_id=".*" can transform the pattern ^{client_id}-sensors$ into ^.*-sensors$, which incorrectly matches any topic ending in -sensors.

Details

The Vulnerability

Administrators can configure topic permissions using regular expressions that include variables like {client_id}. The intended behavior is to substitute this variable with the client's ID, thus restricting their access to a specific set of topics. For example, a user with client_id="device123" should only be able to access topics like device123-sensors and device123-telemetry.

The vulnerability exists because the client_id from the MQTT CONNECT packet is directly substituted into the regex pattern without escaping. This allows an attacker to inject regex metacharacters. For example, by providing a client_id of .*, the regex becomes overly permissive.

Impact

This vulnerability allows an authenticated MQTT user to bypass all topic authorization checks. This can lead to:

• Unauthorized Data Access: Attackers can subscribe to any topic and read sensitive data.
• Unauthorized Actions: Attackers can publish messages to restricted topics, potentially leading to unauthorized actions within the system.

Workarounds

One of:

1. Disable the MQTT plugin
2. Do not use/rely on variable expansion in topic authorization
3. Switch to using separate users per client instead of topic authorization with extrapolated variables such as client_id