data/reports: add GO-2023-2133.yaml

Aliases: GHSA-fr2g-9hjm-wr23 Fixes #2133 Change-Id: Ia8704254316c8b18ce3362692f8358aaa8f3fcd9 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/537435 TryBot-Result: Gopher Robot <[email protected]> Run-TryBot: Tatiana Bradley <[email protected]> Reviewed-by: Damien Neil <[email protected]>
golang · Oct 24, 2023 · 06e31f5 · 06e31f5
1 parent 66da60b
commit 06e31f5
Show file tree

Hide file tree

Showing 2 changed files with 161 additions and 0 deletions.
diff --git a/data/osv/GO-2023-2133.json b/data/osv/GO-2023-2133.json
@@ -0,0 +1,95 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2023-2133",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "GHSA-fr2g-9hjm-wr23"
+  ],
+  "summary": "Authorization bypass in github.com/nats-io/nats-server/v2",
+  "details": "Without any authorization rules in the nats-server, users can connect without authentication.\n\nBefore nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an \"authorization\" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, \"$G\". Users inside accounts go into the newer \"accounts\" block.\n\nIf an \"accounts\" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account \"$SYS\", the nats-server would create an implicit user in \"$G\" and set it as the `no_auth_user` account, enabling the same \"without authentication\" logic as without any rules.\n\nThis preserved the ability to connect simply, and then add one authenticated login for system access.\n\nBut with an \"authorization\" block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.\n\nIn the fixed versions, using an \"authorization\" block will inhibit the implicit creation of a \"$G\" user and setting it as the `no_auth_user` target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/nats-io/nats-server/v2",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "2.2.0"
+            },
+            {
+              "fixed": "2.9.23"
+            },
+            {
+              "introduced": "2.10.0"
+            },
+            {
+              "fixed": "2.10.2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/nats-io/nats-server/v2/server",
+            "symbols": [
+              "ConfigureOptions",
+              "New",
+              "NewServer",
+              "Options.ProcessConfigFile",
+              "Options.processConfigFileLine",
+              "ProcessConfigFile",
+              "Run",
+              "Server.EnableJetStream",
+              "Server.Reload",
+              "Server.ReloadOptions",
+              "Server.SetDefaultSystemAccount",
+              "Server.SetSystemAccount",
+              "Server.Start",
+              "Server.configureAccounts"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "FIX",
+      "url": "https://github.com/nats-io/nats-server/pull/4605"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://advisories.nats.io/CVE/secnote-2023-01.txt"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/nats-io/nats-server/discussions/4535"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nats-io/nats-server/releases/tag/v2.10.2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nats-io/nats-server/releases/tag/v2.9.23"
+    }
+  ],
+  "credits": [
+    {
+      "name": "Alex Herrington"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2023-2133"
+  }
+}
diff --git a/data/reports/GO-2023-2133.yaml b/data/reports/GO-2023-2133.yaml
@@ -0,0 +1,66 @@
+id: GO-2023-2133
+modules:
+    - module: github.com/nats-io/nats-server/v2
+      versions:
+        - introduced: 2.2.0
+          fixed: 2.9.23
+        - introduced: 2.10.0
+          fixed: 2.10.2
+      vulnerable_at: 2.10.1
+      packages:
+        - package: github.com/nats-io/nats-server/v2/server
+          symbols:
+            - Options.processConfigFileLine
+            - Server.configureAccounts
+          derived_symbols:
+            - ConfigureOptions
+            - New
+            - NewServer
+            - Options.ProcessConfigFile
+            - ProcessConfigFile
+            - Run
+            - Server.EnableJetStream
+            - Server.Reload
+            - Server.ReloadOptions
+            - Server.SetDefaultSystemAccount
+            - Server.SetSystemAccount
+            - Server.Start
+summary: Authorization bypass in github.com/nats-io/nats-server/v2
+description: |-
+    Without any authorization rules in the nats-server, users can connect without
+    authentication.
+
+    Before nats-server 2.2.0, all authentication and authorization rules for a
+    nats-server lived in an "authorization" block, defining users. With nats-server
+    2.2.0 all users live inside accounts. When using the authorization block, whose
+    syntax predates this, those users will be placed into the implicit global
+    account, "$G". Users inside accounts go into the newer "accounts" block.
+
+    If an "accounts" block is defined, in simple deployment scenarios this is often
+    used only to enable client access to the system account. When the only account
+    added is the system account "$SYS", the nats-server would create an implicit
+    user in "$G" and set it as the `no_auth_user` account, enabling the same
+    "without authentication" logic as without any rules.
+
+    This preserved the ability to connect simply, and then add one authenticated
+    login for system access.
+
+    But with an "authorization" block, this is wrong. Users exist in the global
+    account, with login rules. And in simple testing, they might still connect fine
+    without administrators seeing that authentication has been disabled.
+
+    In the fixed versions, using an "authorization" block will inhibit the implicit
+    creation of a "$G" user and setting it as the `no_auth_user` target. In unfixed
+    versions, just creating a second account, with no users, will also inhibit this
+    behavior.
+ghsas:
+    - GHSA-fr2g-9hjm-wr23
+credits:
+    - Alex Herrington
+references:
+    - fix: https://github.com/nats-io/nats-server/pull/4605
+    - fix: https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478
+    - advisory: https://advisories.nats.io/CVE/secnote-2023-01.txt
+    - report: https://github.com/nats-io/nats-server/discussions/4535
+    - web: https://github.com/nats-io/nats-server/releases/tag/v2.10.2
+    - web: https://github.com/nats-io/nats-server/releases/tag/v2.9.23