Authorization Bypass in Eclipse Hono AMQP and MQTT Protocol Adapters

CVE-2020-27220

What is CVE-2020-27220?

The Eclipse Hono AMQP and MQTT protocol adapters have a critical oversight in their authorization checks. These adapters fail to verify whether an authenticated gateway device is permitted to receive command and control messages directed at other devices. Specifically, a gateway device may process messages intended for a specific device without confirming that it has the necessary permissions to act on behalf of that device. This vulnerability can be exploited by an authenticated device of the same tenant, potentially allowing it to intercept command messages intended for another device. As a result, unauthorized actions may occur, leading to a potential compromise of device integrity and security within the same tenant environment.

References