CVE-2022-28357
📋 TL;DR
CVE-2022-28357 is a directory traversal vulnerability in NATS nats-server that allows management accounts to access arbitrary files outside the intended directory. This affects NATS servers versions 2.2.0 through 2.7.4 with management accounts enabled. Attackers with management credentials can read sensitive files on the server.
💻 Affected Systems
- NATS nats-server
📦 What is this software?
Nats Server by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via reading sensitive configuration files, credentials, or SSH keys leading to complete system takeover.
Likely Case
Unauthorized access to sensitive server files containing configuration data, credentials, or application data.
If Mitigated
Limited impact if management accounts are disabled or properly restricted with network controls.
🎯 Exploit Status
Exploitation requires valid management account credentials. Public proof-of-concept demonstrates file reading via path traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.0 and later
Vendor Advisory: https://advisories.nats.io/CVE/CVE-2022-28357.txt
Restart Required: Yes
Instructions:
1. Download NATS server version 2.8.0 or later from https://github.com/nats-io/nats-server/releases
2. Stop the running NATS server
3. Replace the nats-server binary with the patched version
4. Restart the NATS server
5. Verify the version with 'nats-server -v'
🔧 Temporary Workarounds
Disable Management Accounts
allRemove or disable management account configuration to eliminate the attack vector
Edit nats-server.conf and remove or comment out 'accounts' section with management permissions
Remove any 'management' account definitions from configuration
Network Access Control
linuxRestrict access to management endpoints using firewall rules
iptables -A INPUT -p tcp --dport 8222 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 8222 -j DROP
🧯 If You Can't Patch
- Disable management accounts completely in configuration
- Implement strict network segmentation to isolate NATS management endpoints from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if running NATS server version 2.2.0-2.7.4 AND management accounts are enabled in configurationCheck Version:
nats-server -vVerify Fix Applied:
Verify nats-server version is 2.8.0 or higher with 'nats-server -v'📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in NATS logs
- Multiple failed management authentication attempts followed by successful access
Network Indicators:
- Unusual HTTP requests to management port (default 8222) with path traversal patterns like '../'
SIEM Query:
source="nats-server" AND (http_request="*..*" OR http_request="*%2e%2e*")