eclipse-paho / eclipse-paho/paho.mqtt.java

Security: Client ID used as thread name

Open
#922 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.3k
Forks
919
PR merge metrics
No merged PRs in 30d

Description

So I am noticing that MQTT3 & MQTT5 drivers use the client ID as part of the name for various background threads. Here's one example of it being passed thru:

https://github.com/eclipse/paho.mqtt.java/blob/master/org.eclipse.paho.mqttv5.client/src/main/java/org/eclipse/paho/mqttv5/client/internal/ClientComms.java#L785

My understanding is that the client ID is essentially intended as a sort of "cookie" that uniquely identifies a session, such that stealing that client ID means you can steal someone's session. Just as an example, a lot of logging frameworks log the current Thread name, which is usually useful for diagnostics, but logging credentials is generally considered a security anti-pattern. So I think "leaking" that client ID out like this is a security risk.

I haven't actually demoed a successful "session stealing" attempt like this; just relying on what I've seen indicated in documentation for other MQTT systems. I know VerneMQ authors specifically insisted that the client ID identifies the session.

If I check on thread names at runtime when subscribing to a topic, I'll typically see
```
MQTT Con:
MQTT Rec:
MQTT Snd:
MQTT Call:
MQTT Ping:
```
\- where `` is my client id.

- [X] Bug exists Release Version 1.2.5 ( Master Branch)
- [ ] Bug exists in MQTTv3 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
- [ ] Bug exists in MQTTv5 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)

Contributor guide

Open the contributing guide

Research direction

Start at org.eclipse.paho.mqttv5.client.internal.ClientComms.java around line 785 and inspect how the MQTT3 and MQTT5 clients construct background thread names. Reproduce the listed runtime names while subscribing to a topic, then verify that completed thread names no longer expose the client ID.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.