NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

2024-07-1121:31:12

CWE-863

GitHub Advisory Database

github.com

nats

streaming

server

negative user permissions

security restrictions

vulnerability

remote attacker

bypass

queue subscription

AI Score

6.9

Confidence

Low

JSON

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.

Affected configurations

Vulners

Node

natsnats_streaming_serverRange<0.24.6

github.com\/natsio\/jwt\/v2Range<2.8.2

VendorProductVersionCPE
natsnats_streaming_server*cpe:2.3:a:nats:nats_streaming_server:*:*:*:*:*:*:*:*
github.com\/natsio\/jwt\/v2*cpe:2.3:a:github.com\/nats:io\/jwt\/v2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nats	nats_streaming_server	*	cpe:2.3:a:nats:nats_streaming_server::::::::
github.com\/nats	io\/jwt\/v2	*	cpe:2.3:a:github.com\/nats:io\/jwt\/v2::::::::