GHSA-55h8-8g96-x4hj
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/nats-io/nats-server/v2 | < 2.11.15 | 2.11.15 |
| Go | github.com/nats-io/nats-server/v2 | >= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| Go | github.com/nats-io/nats-server | all versions | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. NATS messages can have headers.
### Problem Description
The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.
A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked.
Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.
Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.
### Affected Versions
Any version before v2.12.6 or v2.11.15
### Workarounds
None.
References
External links from the advisory. They lead to third-party sites.