## Basic information **Project name:** Mosquitto https://github.com/eclipse/mosquitto **Project id:** (I do not know how to find it) ## What are the affected versions? I tested Mosquitto versions 2.0.9 and 2.0.15 in live environments. Following this, I scrutinized the affected code and discovered that seemingly all versions are subject to the vulnerability. ## Details of the issue > The vuln is found by songxiangpu (SCHOOL OF CYBER SCIENCE AND TECHNOLOGY of SHANDONG UNIVERSITY). The vulnerability occurs in the mosquitto running under bridge mode. When mosquitto actively establishes a bridge with any remote MQTT broker, due to varying levels of implementation compliance of other MQTT brokers, messages published on topics starting with a wildcard may be forwarded to mosquitto. Subsequently, mosquitto triggers a double-free vulnerability, causing the program to crash. The reason for this problem is that the validation of the bridge Broker send message is bypassed.  ## Steps to reproduce **test_br.conf** ```plaintext listener 1883 allow_anonymous true connection bridge1 address 127.0.0.1:1884 keepalive_interval 60 topic room1/# both 2 sensor/ myhouse/ topic tst/ba both 2 topic # both 2 keepalive_interval 600 remote_clientid mosquitto bridge_protocol_version mqttv50 notifications false ``` I provided a Python script to help replay such vuln **server.py** [server.py](/uploads/5ae74a6af5dd3a722dae32c74dae4642/server.py) **Steps:** 1. Run the script: python3 server.py 2. Run mosquitto: ./mosquitto -c ./test_br.conf -v 3. The vuln occured ## Do you know any mitigations of the issue? (Like disabling a configuration option, for example)