漏洞总结：NanoMQ URI 参数解析中的堆缓冲区溢出 漏洞概述 在 NanoMQ 的 REST API 中， 函数存在一个远程触发的堆缓冲区溢出漏洞。该漏洞发生在分配内存以存储查询参数键和值时，允许攻击者向已分配的缓冲区之外写入空终止符。此漏洞可通过构造的 HTTP 请求触发。 影响范围 软件包: 受影响版本: 严重程度: 中等 (Moderate) CVE ID: CVE-2025-32135 修复方案 目前尚无补丁版本（None）。 漏洞详情 根本原因 在 文件中， 函数处理 URI 查询参数。它遍历参数字符串并为键和值缓冲区分配内存，使用 。然而，它在写入这些缓冲区时未能考虑空终止符。 代码示例 当 为 时， 为 3。 分配 3 个字节。 写入 （4 个字节），导致 1 字节的溢出。 概念验证 (PoC) 步骤 1. 使用 ASAN 编译 nanomq。 2. 运行 nanomq。 3. 跟踪日志。 4. 运行以下 curl 命令并观察 ASAN 输出： 示例日志 ```text Abort finding default config path path /root/targets/nanomq/clean_nanomq/build/nanomq/nanomq Set new conf path from env: (null) 2025-01-25 12:06:15 [200560] INFO: [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f000