Import token permissions checking not enforced in github.com/nats-io/nats-server/v2
Summary
CVE-2021-3127: github.com/nats-io/nats-server Import token permissions checking not enforced. Affects github.com/nats-io/nats-server/v2 versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt/v2 · Go
- github.com/nats-io/jwt · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2021-3127 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/nats-io/nats-server/v2 package is a Go package that provides the NATS server, which allows for Subjects that are namespaced by Account. Subjects are meant to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects. The package includes a JWT library for validating tokens. However, prior to version 2.0.1, the library did not enforce permissions checking for Import tokens, allowing any account to reuse an Import token from another account and access any Subject from the exporting account. This vulnerability can be exploited by uploading a tampered Account JWT to the Account Server.
Vulnerability Detail
The lack of enforcement of permissions checking for Import tokens in the JWT library used by github.com/nats-io/nats-server/v2 allows any account to reuse an Import token from another account and gain access to any Subject from the exporting account. This can lead to unauthorized access to sensitive information and abuse of the Export/Import system. The vulnerability affects all versions of the JWT library prior to 2.0.1 and versions of the NATS Server prior to 2.2.0.
How To Fix
Minimum fixed version
2.2.0
This is the first release that contains the fix.
go get github.com/nats-io/nats-server/v2@v2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to deny access to clients to update their account JWT in the account server.
Conclusion
The Import token permissions checking vulnerability in github.com/nats-io/nats-server/v2 allows unauthorized access to Subjects from exporting accounts. It is crucial to upgrade the JWT library and NATS Server to the fixed versions to mitigate this vulnerability. Additionally, auditing account JWTs and implementing the recommended workaround can help prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects. Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.
The JWT library is affected in all versions prior to 2.0.1. The NATS Server is affected in versions prior to 2.2.0, including versions 2.0.0 through 2.1.9.
To mitigate the risk, it is recommended to upgrade the JWT library to version 2.0.1 or later. If using NATS Accounts, upgrade to NATS Server version 2.2.0 or later. Additionally, auditing all account JWTs can help identify potential exploit attempts.
Yes, a workaround for this vulnerability is to deny access to clients to update their account JWT in the account server.
More information about this vulnerability can be found in the official advisory at https://advisories.nats.io/CVE/CVE-2021-3127.txt
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
