NATS-Server Fails to Authorize Certain Jetstream Admin APIs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.10.27, 2.11.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- nats-io nats-server
From 2.2.0 · fixed in 2.10.27; From 2.11.0-RC.1 · fixed in 2.11.1
- github.com/nats-io/nats-server/v2Go
From 2.2.0 · fixed in 2.10.27; From 2.11.0 · fixed in 2.11.1
- github.com/nats-io/nats-server/v2Go
From 2.11.0-RC.1 · fixed in 2.11.1
- github.com/nats-io/nats-server/v2Go
From 2.2.0 · fixed in 2.10.27