PoC and reports for HiveMQ Cloud. MQTT Will / session / retain / v5 properties are filed because attackers can use them. Spec-compliant is not the same as safe.
| Dir | Issue |
|---|---|
will-message-injection |
Will publishes to a topic the client never PUBLISHed |
clean-session-destroy |
Clean Start=1 wipes another user's session |
will-retain-persistence |
Retained Will plants persistent state |
clientid-session-binding |
Session resume keyed by Client ID only |
zombie-sessions |
Max Session Expiry + # queues traffic offline |
will-expiry-persistence |
Will + retain + max expiry |
disconnect-will-trigger |
DISCONNECT 0x04 fires Will on demand |
publish-payload-injection |
No topic ACL; any login can PUBLISH anywhere |
response-topic-redirect |
MQTT v5 Response Topic confused deputy |
correlation-data-spoof |
Correlation Data reused on a fake response |
user-property-spoof |
User Properties used as forged identity |
content-type-spoof |
Content-Type used as forged dispatch key |
payload-format-indicator |
PFI=1 not UTF-8 checked |
will-correlation-injection |
Will carries forged Correlation Data / Response Topic |
retain-expiry-persistence |
Retained PUBLISH with max expiry |