CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
41.2%
Without any authorization rules in the nats-server, users can connect without authentication.
Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an “authorization” block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, “$G”. Users inside accounts go into the newer “accounts” block.
If an “accounts” block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account “$SYS”, the nats-server would create an implicit user in “$G” and set it as the “no_auth_user” account, enabling the same “without authentication” logic as without any rules.
This preserved the ability to connect simply, and then add one authenticated login for system access.
But with an “authorization” block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.
In the fixed versions, using an “authorization” block will inhibit the implicit creation of a “$G” user and setting it as the “no_auth_user” target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.
advisories.nats.io/CVE/secnote-2023-01.txt
github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478
github.com/nats-io/nats-server/discussions/4535
github.com/nats-io/nats-server/pull/4605
github.com/nats-io/nats-server/releases/tag/v2.10.2
github.com/nats-io/nats-server/releases/tag/v2.9.23