eclipse-paho / eclipse-paho/paho.mqtt.java
Security: Client ID used as thread name
- Dominant language
- Java
- Stars
- 2.3k
- Forks
- 919
- PR merge metrics
- No merged PRs in 30d
Description
So I am noticing that MQTT3 & MQTT5 drivers use the client ID as part of the name for various background threads. Here's one example of it being passed thru:
https://github.com/eclipse/paho.mqtt.java/blob/master/org.eclipse.paho.mqttv5.client/src/main/java/org/eclipse/paho/mqttv5/client/internal/ClientComms.java#L785
My understanding is that the client ID is essentially intended as a sort of "cookie" that uniquely identifies a session, such that stealing that client ID means you can steal someone's session. Just as an example, a lot of logging frameworks log the current Thread name, which is usually useful for diagnostics, but logging credentials is generally considered a security anti-pattern. So I think "leaking" that client ID out like this is a security risk.
I haven't actually demoed a successful "session stealing" attempt like this; just relying on what I've seen indicated in documentation for other MQTT systems. I know VerneMQ authors specifically insisted that the client ID identifies the session.
If I check on thread names at runtime when subscribing to a topic, I'll typically see
```
MQTT Con:
MQTT Rec:
MQTT Snd:
MQTT Call:
MQTT Ping:
```
\- where `` is my client id.
- [X] Bug exists Release Version 1.2.5 ( Master Branch)
- [ ] Bug exists in MQTTv3 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
- [ ] Bug exists in MQTTv5 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
Contributor guide
Research direction
Start at org.eclipse.paho.mqttv5.client.internal.ClientComms.java around line 785 and inspect how the MQTT3 and MQTT5 clients construct background thread names. Reproduce the listed runtime names while subscribing to a topic, then verify that completed thread names no longer expose the client ID.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100