Import Loops in Account Imports, nats-server DoS - Vulnerability in github.com/nats-io/nats-server/v2
Summary
GHSA-gwj5-3vfq-q992: Import loops in account imports, nats-server DoS. Affects github.com/nats-io/nats-server/v2 versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/nats-io/nats-server/v2 package is a Go package that provides the functionality of a NATS server. NATS is a lightweight and high-performance messaging system that allows communication between distributed systems. The nats-server package is responsible for handling account imports in NATS, which allows users to export and import accounts. However, a vulnerability exists in versions prior to 2.2.0 that can lead to a denial-of-service (DoS) attack on the nats-server.
Vulnerability Detail
The vulnerability in the nats-server package arises from an export/import cycle between accounts. This cycle can cause the server to crash after consuming excessive CPU and memory resources. Attackers can exploit this vulnerability to disrupt the operation of the nats-server, potentially leading to service downtime. The issue was fixed in version 2.2.0 of the nats-server package.
How To Fix
Minimum fixed version
2.2.0
This is the first release that contains the fix.
go get github.com/nats-io/nats-server/v2@v2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the nats-server package is not immediately feasible, a temporary workaround is to restrict new account sign-ups. By preventing new accounts from being created, the import cycle that triggers the vulnerability can be hindered, reducing the risk of exploitation.
Conclusion
The vulnerability in the github.com/nats-io/nats-server/v2 package allows for a denial-of-service attack on the nats-server. It is crucial to upgrade to version 2.2.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, restricting new account sign-ups can provide a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
The vulnerability can lead to a denial-of-service (DoS) attack on the nats-server, causing it to crash after consuming excessive resources.
Versions prior to 2.2.0 of the nats-server package are affected. Specifically, versions 2.0.0 through 2.1.9 are vulnerable.
No, this vulnerability does not allow for remote code execution. It is limited to a denial-of-service attack on the nats-server.
Yes, restricting new account sign-ups can serve as a temporary workaround to hinder the import cycle that triggers the vulnerability.
Yes, the vulnerability has been fixed in version 2.2.0 of the nats-server package.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
