PT-2023-30299 · Nats+1 · Nats Nats-Server+1

Alex Herrington

·

Publicado

2023-10-19

·

Atualizado

2023-11-08

·

CVE-2023-47090

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions NATS nats-server versions 2.2.0 through 2.9.22 NATS nats-server versions 2.10.0 through 2.10.1
Description The issue is related to an authentication bypass in NATS nats-server. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. Without any authorization rules in the nats-server, users can connect without authentication. The problem arises from the use of an "authorization" block, whose syntax predates the newer "accounts" block, where users are placed into the implicit global account, "$G".
Recommendations For NATS nats-server versions 2.2.0 through 2.9.22, upgrade to at least version 2.9.23. For NATS nats-server versions 2.10.0 through 2.10.1, upgrade to at least version 2.10.2. As a temporary workaround, define a second non-system account in the "accounts" block, leaving it empty, to inhibit the implicit creation of a "$G" user and setting it as the no auth user target. Alternatively, complete the migration of authorization entries to be inside a named account in the "accounts" block.

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

AZL-31779
AZL-35301
CVE-2023-47090
GHSA-4FRV-5FJ6-4P25
GHSA-FR2G-9HJM-WR23
GO-2023-2133

Produtos afetados

Debian
Nats Nats-Server