CVE-2020-26149: NATS JavaScript client TLS private key exposure

CVE-2020-26149 · Severity: low · CVSS 3.1 · Published 2020-10-08

NATS JavaScript-based client libraries send connection configuration options unfiltered to the server after TLS handshake, exposing sensitive data including TLS private key material. Organizations using mutual TLS (mTLS) authentication between clients and servers risk disclosure of cryptographic credentials if connected to an untrusted server or if TLS verification is disabled.

Vendors: NATS, npm.

Quick answers

Is CVE-2020-26149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-26149 being exploited in the wild.
How severe is CVE-2020-26149?
Low severity, with a CVSS score of 3.1, published 8 October 2020.
Which products and versions are affected?
Nats.Deno prior to v1.0.0-9 (preview); Nats.Js 2.0.0-201 to 2.0.0-206 (beta branch); nats (npm) SEMVER:introduced=2.0.0-201,fixed=2.0.0-209; nats.ws (npm) SEMVER:introduced=1.0.0-85,fixed=1.0.0-111.
Is there a fix for CVE-2020-26149?
Yes. nats (npm): upgrade to 2.0.0-209 or later; nats.ws (npm): upgrade to 1.0.0-111 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-26149 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-26149?
Check whether you run Nats.Deno, Nats.Js, nats (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nats (npm): upgrade to 2.0.0-209 or later
    npm install nats@2.0.0-209
  • nats.ws (npm): upgrade to 1.0.0-111 or later
    npm install nats.ws@1.0.0-111

Technical details

A logic flaw in NATS JavaScript client libraries causes the connection configuration object to be fully serialized and transmitted to the server in the CONNECT message immediately after TLS establishment. For nats.js with mutual TLS support, this includes TLS client private key material. The vulnerability affects preview/beta versions only: nats.js 2.0.0-201 through 2.0.0-206, nats.ws 1.0.0-85 through 1.0.0-110, and nats.deno prior to v1.0.0-9. An attacker operating an untrusted NATS server, or an attacker who can disable client-side TLS verification, can intercept the CONNECT message and extract private key credentials. NKey authentication is not affected. Fixes are available in nats.js 2.0.0-209, nats.ws 1.0.0-111, and nats.deno v1.0.0-9 or later.

Affected products

  • NATS nats.js 2.0.0-201 to 2.0.0-206 (beta branch)
  • NATS nats.ws 1.0.0-85 to 1.0.0-110 (preview)
  • NATS nats.deno prior to v1.0.0-9 (preview)

Identifiers

  • CVE-2020-26149
  • GHSA-82rf-q3pr-4f6p

Timeline

  • 2020-10-08: disclosed: Advisory published
  • 2020-09-30: other: Security issue reported via oss-security mailing list

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.