Summary
Moquette contains an authorization flaw in pattern-based MQTT ACL rules that can let specially formed client IDs or usernames alter the meaning of substituted topic filters. In affected configurations, an attacker may gain cross-tenant read or write access, while certain malformed identities may also disrupt session processing.
Affected context
The issue occurs in Moquette deployments that use pattern-based ACL rules with identity substitutions such as %c or %u. It becomes risky when client-supplied IDs or usernames are inserted into topic filters without ensuring that MQTT wildcard characters remain data rather than filter syntax.
Exploit preconditions
- Attack surface: MQTT authentication and authorization handling
- Required access: The ability to connect with a client identity accepted by the broker
- Trigger point: Authorization checks that substitute the client ID or username into a pattern-based ACL rule
- Why exploitation is possible: Wildcard characters in the identity can broaden the resulting topic filter or create an invalid filter before authorization is completed
Why this happens
The underlying bug is improper neutralization of wildcard and matching characters, mapped primarily to CWE-155. Moquette substitutes client-controlled identity values into ACL patterns and then interprets the combined result as an MQTT topic filter. Without context-aware escaping, validation, or a strict separation between literal identity data and filter syntax, attacker-controlled characters can change authorization semantics. The resulting access-control failure is also related to CWE-863, Incorrect Authorization.
Potential impact
- An attacker may read topics belonging to other tenants.
- An attacker may publish or modify messages in unauthorized topics.
- Sensitive MQTT data may be disclosed across authorization boundaries.
- A malformed identity may trigger processing errors and cause session disruption.
- Dependent applications may experience data integrity or availability issues.
General mitigation guidance
Mitigation generally focuses on preserving the distinction between literal
identity values and MQTT filter syntax.
Common defensive patterns include:
- Escaping or rejecting wildcard characters when identity values are inserted into ACL patterns.
- Using structured authorization rules that compare identities and topics as separate fields.
- Applying strict validation and canonicalization to client IDs and usernames.
- Enforcing tenant-scoped topic authorization by default and denying ambiguous filters.
- Handling invalid filters safely without allowing authorization failures to disrupt sessions.
- Running broker processes with only the permissions required for messaging operations.
- Protecting ACL configuration from unauthorized modification and testing rules with adversarial identity values.
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis patterns that identify string substitution into authorization or topic-filter logic.
- Code review checks for unescaped client-controlled values used in wildcard-aware APIs.
- Tests covering plus and hash characters, malformed filters, empty identities, and tenant-boundary access.
- Runtime monitoring for unexpected cross-tenant subscriptions or publications.
- Policy enforcement requiring explicit tenant scoping and deny-by-default ACL behavior.
- Automated security review tools that flag authorization decisions built from untrusted string concatenation.
