Authentication Bypass in Nango Runner Leads to RCE

Executive Summary

Nango before version 0.71.6 has a missing authentication vulnerability in its runner tRPC server. This flaw allows unauthenticated attackers to execute arbitrary JavaScript code by calling the exposed start procedure without providing credentials. The vulnerability exists because the RUNNER_SECRET_KEY environment variable is not enforced, enabling attackers with network access to the runner port to send requests and achieve remote code execution within the runner process.

Useful 0 Not Useful 0

Detection Guidance

Check if the Nango runner tRPC server is exposed on the network without authentication. Look for open ports where the runner service is running. Inspect network traffic for requests to the unauthenticated start procedure. Verify if the RUNNER_SECRET_KEY environment variable is missing or unenforced.

Useful 0 Not Useful 0

Impact Analysis

If you use Nango before 0.71.6, attackers could gain control of your runner process, allowing them to run malicious JavaScript code on your system. This could lead to unauthorized access, data theft, or further compromise of your infrastructure. The impact depends on the privileges of the runner process and the sensitivity of the data it handles.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR, HIPAA, or other regulations. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful exploit could result in non-compliance, legal penalties, or reputational damage due to compromised sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nango to version 0.71.6 or later to address the missing authentication flaw. Ensure the RUNNER_SECRET_KEY environment variable is properly set and enforced. Restrict network access to the runner port to trusted sources only. Monitor for unauthorized access attempts or suspicious activity.

Useful 0 Not Useful 0