CVE-2022-29946

Vulnerability

Overview

NATS.io NATS Server before version 2.8.2 and Streaming Server before version 0.24.6 contain a vulnerability in the permission enforcement mechanism. The root cause is the failure to enforce negative user permissions in a specific scenario involving queue subscriptions on wildcard subjects [1][2].

Exploitation

Conditions

A remote attacker can exploit this vulnerability by establishing a queue subscription on a wildcard subject. The attacker must have network access to the NATS server and valid user credentials. The attack does not require any special privileges beyond being an authenticated user. The server fails to apply configured denys (negative permissions) when processing queue subscriptions against wildcard patterns [1][3].

Impact

Successful exploitation allows an attacker to bypass security restrictions and access subjects that should be denied by the user's permissions. This could lead to unauthorized reading of messages or publication to subjects that the administrator intended to restrict [2].

Mitigation

The vulnerability has been patched in NATS Server 2.8.2 and NATS Streaming Server 0.24.6. Users are strongly recommended to upgrade to these versions or later. There is no evidence of active exploitation in the wild, and the CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1][3].