Nil dereference in NATS JWT, DoS of nats-server
Summary
CVE-2020-26521: Nil dereference in NATS JWT causing DoS of nats-server. Affects github.com/nats-io/nats-server/v2 versions < 2.1.9. Fixed in 2.1.9. How to fix ↓
Also tracked for
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2020-26521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The NATS server is an open-source messaging system that provides a lightweight and high-performance communication platform. It utilizes the NATS account system, which allows for the creation and management of user accounts. The server relies on a JWT library written in Go to handle authentication and authorization. However, a vulnerability has been discovered in the JWT library that can lead to a denial of service (DoS) attack on the nats-server. This vulnerability affects versions prior to 1.1.0 of the JWT library and versions prior to 2.1.9 of the NATS server.
Vulnerability Detail
The vulnerability arises from a nil dereference issue in the NATS JWT library. A malicious account can create and sign a user JWT with a state that is not created by the normal tooling. When the JWT is decoded by the NATS JWT library, it attempts a nil dereference, causing the execution to abort. This vulnerability can be exploited to cause a DoS attack on the nats-server, resulting in process termination. The severity of this vulnerability is rated as LOW with a CVSS score of 7.5.
How To Fix
Minimum fixed version
2.1.9
This is the first release that contains the fix.
go get github.com/nats-io/nats-server/v2@v2.1.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If your NATS servers do not trust any accounts managed by untrusted entities, you can implement a workaround by ensuring that only trusted accounts are used. This reduces the risk of encountering malformed user credentials.
Conclusion
In conclusion, the NATS server is vulnerable to a nil dereference issue in the NATS JWT library, which can result in a denial of service (DoS) attack. It is recommended to upgrade the JWT dependency and ensure that trusted accounts are used to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
The impact of this vulnerability is a denial of service (DoS) attack on the nats-server, leading to process termination.
The JWT library versions prior to 1.1.0 and the NATS server versions prior to 2.1.9 are affected by this vulnerability.
This vulnerability is rated as LOW with a CVSS score of 7.5.
To fix this vulnerability, upgrade the JWT dependency in your application and ensure that your NATS servers do not trust any accounts managed by untrusted entities.
Yes, if your NATS servers do not trust any accounts managed by untrusted entities, you can reduce the risk of encountering malformed user credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
