Mosquitto MQTT Password File Exposure in boneIO black_debian_images

Executive Summary

The vulnerability involves boneIO black_debian_images storing the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. This allows any local user to read password hashes for all MQTT accounts and perform offline dictionary attacks.

Useful 0 Not Useful 0

Detection Guidance

Check if the file /etc/mosquitto/passwd has world-readable permissions by running: ls -l /etc/mosquitto/passwd. If permissions show as -rw-r--r-- or similar, the file is readable by all users. Verify if the file contains password hashes by viewing it with: cat /etc/mosquitto/passwd.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could extract password hashes and attempt to crack them offline, potentially gaining unauthorized access to MQTT accounts. This could lead to further compromise of systems relying on MQTT for communication or data transmission.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by exposing sensitive credentials, potentially leading to unauthorized access to personal or health data. It undermines confidentiality and integrity controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update boneIO black_debian_images to version 1.6.0 or later to fix the issue. If updating is not possible, restrict permissions on /etc/mosquitto/passwd to owner-only read/write using: chmod 600 /etc/mosquitto/passwd. Rotate all MQTT account passwords immediately.

Useful 0 Not Useful 0