CVE-2022-29946 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects
Remote attackers can bypass security restrictions to access denied subjects via queue subscriptions on wildcards in NATS Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29946?
CVE-2022-29946 is a medium-severity authentication bypass vulnerability in n/a, published on 11 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Which versions are affected by CVE-2022-29946?
7 open source packages ship an affected version, including github.com/nats-io/nats-server/v2, github.com/nats-io/nats-server and github.com/nats-io/nats-streaming-server.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nats-io/nats-server/v2 Go | All versions | 2.8.2 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.8.2 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.8.2 |
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-streaming-server Go | All versions | 0.24.6 |
github.com/nats-io/nats-streaming-server Go | All versions | 0.24.6 |
1 more packages
github.com/nats-io/nats-streaming-server Go | All versions | 0.24.6 |
How do I fix CVE-2022-29946?
Upgrade github.com/nats-io/nats-server/v2 to 2.8.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-29946 being exploited?
There is no known exploitation of CVE-2022-29946 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-29946, GHSA-2h2x-8hh2-mfq8, GO-2024-2980.