Description
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| emqx | MQTTX | ≤ 1.13.3 | — |
References
- https://github.com/emqx/MQTTX/issues/2180 issue-tracking
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226 technical-description
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184 technical-description
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283 technical-description
- https://github.com/emqx/MQTTX product
- VulnCheck Advisory: MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips third-party-advisory