CVE-2022-24450

Vulnerability

A coding error in the experimental "dynamically provisioned sandbox accounts" feature of NATS nats-server allows any authenticated user to assume the privileges of any other account, including the System account. The bug exists in all 2.x versions up to and including 2.7.1, and in NATS Streaming Server versions v0.15.0 through v0.24.0 (which embed the affected server). The feature was never documented or supported in client libraries, but remained in the code and was used in tests [2][3].

Exploitation

An attacker with valid credentials for any account can, during the initial protocol-level handshake, specify a target account (such as the System account) and be immediately assigned into that account. No additional privileges or user interaction are required beyond possessing valid credentials for any tenant [2][3].

Impact

Successful exploitation grants the attacker full control over the System account, which governs core nats-server operations. This includes the ability to manage accounts, subjects, and other administrative functions, effectively compromising the entire NATS deployment [2][3].

Mitigation

The vulnerability is fixed in nats-server version 2.7.2 and nats-streaming-server version 0.24.1. The fix removes the experimental feature entirely. No workaround is available; upgrading to the patched versions is the only mitigation [2][3][4].