Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Eclipse Arrowhead that could allow an unauthenticated attacker to gain full management access over the MQTT API. The issue stems from the system's failure to properly validate client-provided X.509 certificates, enabling an attacker to impersonate a system operator by submitting a forged certificate. While the HTTP interface is unaffected, the potential for unauthorized control over critical management functions via MQTT warrants attention for deployments utilizing this specific API.
- Unvalidated certificates grant unauthorized system operator access.
- This could enable unauthorized control of management functions.
- Confirm if the MQTT API is enabled and exposed.
Attack Path
How an attacker could exploit the issue
An attacker with the ability to publish messages to the MQTT broker can impersonate a system operator, gaining full management access. This is achieved by sending a specially crafted, self-signed X.509 certificate within an MQTT message. The system improperly validates this certificate, allowing the attacker to bypass authentication and authorization checks.
- Requires MQTT API enabled with certificate authentication.
- Attacker publishes crafted certificate in MQTT payload.
- Grants full management access as system operator.
Live Threat
Current exploitation, exposure, and threat context
When the MQTT API is enabled with certificate authentication, an attacker could impersonate a system operator by forging a self-signed X.509 certificate. This impersonation grants full management access to the system through the MQTT interface.
- System operator credentials.
- Publishing messages to the MQTT broker.
- Unauthorized system management access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Eclipse Arrowhead MQTT API is vulnerable if certificate authentication is enabled. This allows an attacker to bypass authentication and gain full management access by sending a crafted self-signed certificate. Teams responsible for the Arrowhead application and its underlying infrastructure should coordinate to address this critical exposure. The first practical step is to identify all deployments, confirm reachability and criticality, and then plan remediation based on these findings.
- Application and infrastructure teams own this issue.
- Verify MQTT API enabled with certificate authentication.
- Plan remediation based on identified exposure.
