From 06e31f5fe59429a188ad03b3e468b3541c6642f5 Mon Sep 17 00:00:00 2001 From: Tatiana Bradley Date: Tue, 24 Oct 2023 14:21:33 -0400 Subject: [PATCH] data/reports: add GO-2023-2133.yaml Aliases: GHSA-fr2g-9hjm-wr23 Fixes golang/vulndb#2133 Change-Id: Ia8704254316c8b18ce3362692f8358aaa8f3fcd9 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/537435 TryBot-Result: Gopher Robot Run-TryBot: Tatiana Bradley Reviewed-by: Damien Neil --- data/osv/GO-2023-2133.json | 95 ++++++++++++++++++++++++++++++++++ data/reports/GO-2023-2133.yaml | 66 +++++++++++++++++++++++ 2 files changed, 161 insertions(+) create mode 100644 data/osv/GO-2023-2133.json create mode 100644 data/reports/GO-2023-2133.yaml diff --git a/data/osv/GO-2023-2133.json b/data/osv/GO-2023-2133.json new file mode 100644 index 00000000..82130dd7 --- /dev/null +++ b/data/osv/GO-2023-2133.json @@ -0,0 +1,95 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2023-2133", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-fr2g-9hjm-wr23" + ], + "summary": "Authorization bypass in github.com/nats-io/nats-server/v2", + "details": "Without any authorization rules in the nats-server, users can connect without authentication.\n\nBefore nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an \"authorization\" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, \"$G\". Users inside accounts go into the newer \"accounts\" block.\n\nIf an \"accounts\" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account \"$SYS\", the nats-server would create an implicit user in \"$G\" and set it as the `no_auth_user` account, enabling the same \"without authentication\" logic as without any rules.\n\nThis preserved the ability to connect simply, and then add one authenticated login for system access.\n\nBut with an \"authorization\" block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.\n\nIn the fixed versions, using an \"authorization\" block will inhibit the implicit creation of a \"$G\" user and setting it as the `no_auth_user` target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.", + "affected": [ + { + "package": { + "name": "github.com/nats-io/nats-server/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.9.23" + }, + { + "introduced": "2.10.0" + }, + { + "fixed": "2.10.2" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/nats-io/nats-server/v2/server", + "symbols": [ + "ConfigureOptions", + "New", + "NewServer", + "Options.ProcessConfigFile", + "Options.processConfigFileLine", + "ProcessConfigFile", + "Run", + "Server.EnableJetStream", + "Server.Reload", + "Server.ReloadOptions", + "Server.SetDefaultSystemAccount", + "Server.SetSystemAccount", + "Server.Start", + "Server.configureAccounts" + ] + } + ] + } + } + ], + "references": [ + { + "type": "FIX", + "url": "https://github.com/nats-io/nats-server/pull/4605" + }, + { + "type": "FIX", + "url": "https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478" + }, + { + "type": "ADVISORY", + "url": "https://advisories.nats.io/CVE/secnote-2023-01.txt" + }, + { + "type": "REPORT", + "url": "https://github.com/nats-io/nats-server/discussions/4535" + }, + { + "type": "WEB", + "url": "https://github.com/nats-io/nats-server/releases/tag/v2.10.2" + }, + { + "type": "WEB", + "url": "https://github.com/nats-io/nats-server/releases/tag/v2.9.23" + } + ], + "credits": [ + { + "name": "Alex Herrington" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2023-2133" + } +} \ No newline at end of file diff --git a/data/reports/GO-2023-2133.yaml b/data/reports/GO-2023-2133.yaml new file mode 100644 index 00000000..087aea3c --- /dev/null +++ b/data/reports/GO-2023-2133.yaml @@ -0,0 +1,66 @@ +id: GO-2023-2133 +modules: + - module: github.com/nats-io/nats-server/v2 + versions: + - introduced: 2.2.0 + fixed: 2.9.23 + - introduced: 2.10.0 + fixed: 2.10.2 + vulnerable_at: 2.10.1 + packages: + - package: github.com/nats-io/nats-server/v2/server + symbols: + - Options.processConfigFileLine + - Server.configureAccounts + derived_symbols: + - ConfigureOptions + - New + - NewServer + - Options.ProcessConfigFile + - ProcessConfigFile + - Run + - Server.EnableJetStream + - Server.Reload + - Server.ReloadOptions + - Server.SetDefaultSystemAccount + - Server.SetSystemAccount + - Server.Start +summary: Authorization bypass in github.com/nats-io/nats-server/v2 +description: |- + Without any authorization rules in the nats-server, users can connect without + authentication. + + Before nats-server 2.2.0, all authentication and authorization rules for a + nats-server lived in an "authorization" block, defining users. With nats-server + 2.2.0 all users live inside accounts. When using the authorization block, whose + syntax predates this, those users will be placed into the implicit global + account, "$G". Users inside accounts go into the newer "accounts" block. + + If an "accounts" block is defined, in simple deployment scenarios this is often + used only to enable client access to the system account. When the only account + added is the system account "$SYS", the nats-server would create an implicit + user in "$G" and set it as the `no_auth_user` account, enabling the same + "without authentication" logic as without any rules. + + This preserved the ability to connect simply, and then add one authenticated + login for system access. + + But with an "authorization" block, this is wrong. Users exist in the global + account, with login rules. And in simple testing, they might still connect fine + without administrators seeing that authentication has been disabled. + + In the fixed versions, using an "authorization" block will inhibit the implicit + creation of a "$G" user and setting it as the `no_auth_user` target. In unfixed + versions, just creating a second account, with no users, will also inhibit this + behavior. +ghsas: + - GHSA-fr2g-9hjm-wr23 +credits: + - Alex Herrington +references: + - fix: https://github.com/nats-io/nats-server/pull/4605 + - fix: https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478 + - advisory: https://advisories.nats.io/CVE/secnote-2023-01.txt + - report: https://github.com/nats-io/nats-server/discussions/4535 + - web: https://github.com/nats-io/nats-server/releases/tag/v2.10.2 + - web: https://github.com/nats-io/nats-server/releases/tag/v2.9.23