PT-2023-30299 · Nats+1 · Nats Nats-Server+1

Alex Herrington · Published 2023-10-19 · Updated 2023-11-08 · CVE-2023-47090

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NATS nats-server versions 2.2.0 through 2.9.22 NATS nats-server versions 2.10.0 through 2.10.1

Description The issue is related to an authentication bypass in NATS nats-server. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. Without any authorization rules in the nats-server, users can connect without authentication. The problem arises from the use of an "authorization" block, whose syntax predates the newer "accounts" block, where users are placed into the implicit global account, "$G".

Recommendations For NATS nats-server versions 2.2.0 through 2.9.22, upgrade to at least version 2.9.23. For NATS nats-server versions 2.10.0 through 2.10.1, upgrade to at least version 2.10.2. As a temporary workaround, define a second non-system account in the "accounts" block, leaving it empty, to inhibit the implicit creation of a "$G" user and setting it as the no auth user target. Alternatively, complete the migration of authorization entries to be inside a named account in the "accounts" block.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-305

Related Identifiers

AZL-31779

AZL-35301

CVE-2023-47090

GHSA-4FRV-5FJ6-4P25

GHSA-FR2G-9HJM-WR23

GO-2023-2133

Affected Products

Debian

Nats Nats-Server

References · 27

• https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-47090 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-47090 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-47090 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47090 · Security Note
• https://osv.dev/vulnerability/AZL-35301 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4frv-5fj6-4p25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47090 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2133 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31779 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-47090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-47090 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fr2g-9hjm-wr23 · Vendor Advisory
• https://github.com/nats-io/nats-server · Note
• https://github.com/nats-io/nats-server/pull/4605 · Note