NATS Server Queue Subscription Authorization Bypass (GHSA-j8g9-9g95-6322)

Vulnerability Overview Vulnerability Name: Queue Subscribe Authz Bypass CVE ID: GHSA-j8g9-9g95-6322 Severity: Medium (6.5/10) CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None Description: NATS.io is a high-performance open-source pub-sub distributed communication technology suitable for cloud, on-premises, IoT, and edge computing. The NATS Server authorization system supports topic-based subscription allow and deny rules, including queue subscriptions. Problem Description: An authenticated user with a specific combination of subscription deny permissions can bypass pure topic deny rules by using queue subscriptions. Queue-specific deny evaluations can override the results of pure topic deny evaluations, allowing subscriptions to proceed when the queue name itself is not denied. This may result in users receiving messages on topics that the account configuration intends to deny. This requires the affected user to possess valid credentials and permissions that combine pure topic denials and queue-specific deny rules. Scope of Impact Affected Versions: v2.12.6 v2.11.15 Fixed Versions: v2.14.0 v2.12.7 v2.11.16 Remediation Workaround: Review users with configurations combining pure topic deny rules and queue-specific deny rules. Where possible, avoid granting broad subscription permissions to users relying on queue-specific deny rules until an upgrade is performed. References GHSA Advisory: GHSA-j8g9-9g95-6322 Contributor: XlabAI Team of Tencent Xuanwu Lab

Goal Reached Thanks to every supporter — we hit 100%!

NATS Server Queue Subscription Authorization Bypass (GHSA-j8g9-9g95-6322)

More from this source