PT-2022-16706 · Unknown · Nats Streaming Server+1
Gerardo Iglesias
+1
·
Published
2022-02-08
·
Updated
2024-08-21
·
CVE-2022-24450
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
NATS Server versions prior to 2.7.2
NATS Streaming Server versions prior to 0.24.1
Description
The issue is related to Incorrect Access Control in NATS nats-server, where any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. This is due to a coding error in an experimental feature that allowed clients to authorize into any account. A client can craft the initial protocol-level handshake to switch into any other account, including the System account, which controls nats-server core operations. For deployments not using multi-tenancy, normal users can choose to be in the System account.
Recommendations
For NATS Server versions prior to 2.7.2, upgrade to version 2.7.2 or later.
For NATS Streaming Server versions prior to 0.24.1, upgrade to version 0.24.1 or later.
Fix
Incorrect Authorization
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nats Server
Nats Streaming Server