GHSA-j756-f273-xhp4: 
vulnerability analysis and mitigation

The NATS server vulnerability (CVE-2021-3127) was discovered in NATS Server versions 2.x before 2.2.0 and JWT library before 2.0.1, affecting their Import Token permissions checking mechanism. The vulnerability was disclosed on March 15, 2021, and impacts the NATS server's account-based subject namespace system, specifically the Export/Import system used for cross-account access control (NATS Advisory, GitHub Advisory).

The vulnerability stems from the JWT library's incorrect validation of bindings in Import Tokens. Instead of rejecting mismatched tokens, the system only generated warnings. This implementation flaw allows any account to reuse Import tokens from other accounts and access any Subject from the Exporting account, bypassing intended restrictions. The vulnerability has a CVSS v3.1 base score of 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

In deployments where untrusted accounts can update the Account Server with imports, malicious actors can gain unauthorized access to any Subject from accounts with Exported Subjects. The NATS account-server system's treatment of account JWTs as semi-public information makes it possible for attackers to enumerate all account JWTs and retrieve Import Tokens, though exploitation requires uploading tampered Account JWT to the Account Server (NATS Advisory).

The vulnerability is exploitable in environments where clients have access to update their account JWT in the account server. The exploitation process involves taking an Import token from any other account and reusing it, allowing access to any Subject from the Exporting account, not just the Subject referenced in the Import Token (GitHub Advisory).

As an immediate workaround, administrators should deny access to clients to update their account JWT in the account server. For a permanent fix, users should upgrade the JWT dependency to version 2.0.1 or later in any application using it, and upgrade the NATS server to version 2.2.0 or later if using NATS Accounts with private Exports. Additionally, it's recommended to audit all accounts JWTs to scan for potential exploit attempts using the provided Python script (NATS Advisory).