CVE-2023-47090 NATS.io: Adding accounts for just the system account adds auth bypass

Medium 6.5 Published 30 Oct 2023 Updated 9 Sep 2024

Attackers can bypass authentication in NATS server if an implicit $G user is configured, allowing unauthorized access to the system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-47090?

CVE-2023-47090 is a medium-severity authentication bypass vulnerability in n/a, published on 30 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.

Weakness: CWE-863

Which versions are affected by CVE-2023-47090?

5 open source packages ship an affected version, including github.com/nats-io/nats-server/v2. It affects 1 product.

Package	Affected	Fixed in
`github.com/nats-io/nats-server/v2` Go	From `2.10.0`	`2.10.2`
`github.com/nats-io/nats-server/v2` Go	From `2.10.0`	`2.10.2`
`github.com/nats-io/nats-server/v2` Go	From `2.2.0`	`2.9.23, 2.10.2`
`github.com/nats-io/nats-server/v2` Go	From `2.2.0`	`2.9.23`
`github.com/nats-io/nats-server/v2` Go	From `2.2.0`	`2.9.23`

Products include Linuxfoundation Nats-Server.

How do I fix CVE-2023-47090?

Upgrade github.com/nats-io/nats-server/v2 to a fixed version for your release line: 2.10.2 or 2.9.23.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-47090 being exploited?

There is no known exploitation of CVE-2023-47090 in the wild and no public exploit code.

Sources

Also known as AZL-31779, AZL-35301, DEBIAN-CVE-2023-47090, GHSA-fr2g-9hjm-wr23, GO-2023-2133, JLSEC-2026-1119.