NATS Server Connection Monitoring Request Overflow

Executive Summary

This vulnerability affects the NATS Server, a high-performance messaging server. Before versions 2.14.3 and 2.12.12, a client that could send account-scoped connection monitoring requests was able to crash the server. This was done by supplying Connz pagination Offset and Limit values that caused an overflow in internal arithmetic before the response window was safely bounded.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service by crashing the NATS Server. This means that an attacker with the ability to send specific monitoring requests could disrupt the availability of the messaging system, potentially impacting applications and services that rely on it.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your NATS Server to version 2.14.3 or 2.12.12 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or malicious client requests that send account-scoped connection monitoring requests with pagination Offset and Limit values that are abnormally large or cause integer overflow.

Specifically, you can look for requests targeting the Connz or Subsz endpoints with Offset and Limit parameters whose sum exceeds the maximum integer value, which triggers the crash.

To detect such attempts on your system, you can use network monitoring tools or logs to identify clients sending these suspicious pagination parameters.

Example commands to detect or test this vulnerability might include sending crafted requests to the NATS server's monitoring endpoints with large Offset and Limit values, for example using curl or a similar HTTP client if applicable, or using NATS client tools to publish to the monitoring subjects with extreme pagination parameters.

• Use a NATS client or curl to send a Connz request with Offset and Limit set to very large values (e.g., near or exceeding max int64) to see if the server crashes or panics.
• Monitor server logs for panic or crash messages related to pagination overflow in Connz or Subsz endpoints.
• Restrict or audit publish access to system request subjects related to monitoring to prevent unauthorized clients from sending such requests.

Useful 0 Not Useful 0