CVE-2022-26652

Vulnerability

NATS nats-server before version 2.7.4 and nats-streaming-server before version 0.24.3 contain a directory traversal vulnerability in the JetStream stream restore functionality. The backup and restore mechanism for JetStream streams uses a tar archive, and inadequate validation of filenames within the archive allows a Zip Slip attack [1][2][3][4]. Affected versions are nats-server 2.2.0 through 2.7.3 and nats-streaming-server 0.15.0 through 0.24.2 [3][4].

Exploitation

An attacker must have a NATS account with permission to use JetStream and the ability to initiate a stream restore operation [4]. The attacker crafts a malicious tar archive containing filenames with directory traversal sequences (e.g., ../). When the server processes the archive during restore, it writes files to locations outside the intended JetStream storage directory, subject to the server process's filesystem permissions [3][4]. No additional authentication or user interaction beyond standard JetStream API access is required.

Impact

Successful exploitation allows an attacker to write arbitrary content to arbitrary files on the server filesystem, controlled by the archive's filenames. This can lead to arbitrary code execution if the attacker overwrites critical configuration or executable files, or cause denial of service by corrupting system files [3][4]. The server runs with the privileges of the nats-server process; in typical deployments this may be a limited user, but a compromise of the server host is possible.

Mitigation

Fixed versions are nats-server 2.7.4 and nats-streaming-server 0.24.3, released March 9, 2022 [1][3][4]. Users should upgrade immediately. Workarounds include disabling JetStream for untrusted users, sandboxing the server process (e.g., with systemd's ProtectSystem=strict), or restricting JetStream API access to a single trusted account [3][4].