Loading HuntDB...

unauth mosquitto ( client emails, ips, license keys exposure )

Medium
A
Acronis
Submitted None

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
Hi team ## Summary connect.acronis.com ( ip 88.99.142.45:1883 ) has unauth mosquitto mqtt, anyone can connect and read\write messages ## Steps To Reproduce [add details for how we can reproduce the issue] 1. https://github.com/bapowell/python-mqtt-client-shell 1. python3 mqtt_client_shell.py 1. connection 1. host 88.99.142.45 1. connect 1. subscribe "#" 1 ``` Payload (str): b'{"host":"nusite", "tag":"nusite-licenser", "level":"debug", "msg":" response: {\'commands\': [], \'license_info\': {\'licensee_name\': \'██████████\', \'license_key\': \'█████████\', \'support_exp_date\': \'2021-11-30\', \'licensed_actions\': [{\'names\': [\'*\'], \'rules\': [{\'ops\': [{\'action\': \'allow\'}]}]}]}, \'signature\': \'\'}"}' ``` █████ ## Recommendations enable authentication Thanks ## Impact access to client data, possibility to write messages to unauth mqtt

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$150.00

Submitted

Weakness

Improper Access Control - Generic