GHSA-3f24-pcvm-5jqc
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/nats-io/nats-server/v2 | < 2.11.15 | 2.11.15 |
| Go | github.com/nats-io/nats-server/v2 | >= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| Go | github.com/nats-io/nats-server | all versions | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.
### Problem Description
When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.
This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.
So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.
### Affected Versions
Fixed in nats-server 2.12.6 & 2.11.15
### Workarounds
Developers should review their CA issuing practices.
References
External links from the advisory. They lead to third-party sites.