CVE-2025-30215

Executive Summary

CVE-2025-30215 is a critical authorization bypass vulnerability in NATS-Server, a high-performance messaging system for cloud and edge environments. The flaw resides in the JetStream API management layer, where certain administrative operations on JetStream assets (streams, consumers, stores) are incorrectly exposed across account boundaries. An authenticated user with JetStream management permissions in any account can perform destructive administrative actions on JetStream assets in any other account, without proper authorization checks. The vulnerability allows for data destruction (e.g., deleting streams or purging data) but does not permit reading stream contents. The CVSS score of 9.6 reflects the ease of exploitation and the severe impact on data integrity and availability across multi-tenant deployments.

Supply Chain & Package Security

NATS-Server is distributed as a Go binary and is also available as a container image on Docker Hub (nats:latest, nats:alpine). The vulnerability affects all deployments using JetStream with multi-tenant accounts. Organizations using NATS as a message broker in microservices, IoT, or edge computing environments must prioritize patching. The official Go module (github.com/nats-io/nats-server/v2) is the primary distribution vector. No malicious packages have been reported in the supply chain, but the unpatched state increases risk for unmonitored deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires a valid account with JetStream management permissions.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – The vulnerable component (JetStream API) impacts resources beyond its security scope (other accounts).
• Confidentiality (C): None (N) – Stream contents cannot be read.
• Integrity (I): High (H) – Assets can be modified or deleted.
• Availability (A): High (H) – Assets can be destroyed, causing denial of service.

Threat Level: Critical. The vulnerability allows cross-account data destruction with low privileges, making it highly attractive for attackers in multi-tenant environments.

Deep Dive & Mechanics

NATS-Server uses a system account ($SYS) to manage JetStream assets via internal messages in the $JS. subject namespace. These APIs are partially exposed to regular accounts to allow account holders to manage their own streams and consumers. The vulnerability arises because several JetStream API endpoints lack proper access control checks. Specifically, the server does not verify that the requesting account has authorization to perform administrative actions (e.g., delete stream, purge stream, delete consumer) on assets belonging to another account.

The affected APIs include (but are not limited to):

• $JS.API.STREAM.DELETE.<stream_name>
• $JS.API.STREAM.PURGE.<stream_name>
• $JS.API.CONSUMER.DELETE.<stream_name>.<consumer_name>
• $JS.API.STREAM.UPDATE.<stream_name>

An attacker with JetStream management permissions in any account can craft a request targeting another account's stream by specifying the correct stream name (which may be guessable or enumerable). The server processes the request without validating that the requester's account owns the target asset. This allows unauthorized deletion or purging of streams, leading to data loss.

The vulnerability does not expose stream data (messages) because the read APIs ($JS.API.STREAM.INFO, $JS.API.CONSUMER.LIST, etc.) are properly protected. However, the destructive APIs are not.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.10.27 / 2.11.1): In the JetStream API handler, the server checks if the user has JetStream management permissions but does not verify that the target asset belongs to the user's account. For example, in server/jetstream_api.go:

func (s *Server) jsStreamDeleteRequest(sub *subscription, c *client, subject, reply string, msg []byte) {
    // ... parse request ...
    if !s.JetStreamEnabled() || !s.JetStreamAllowDelete(acc) {
        return
    }
    // Missing: check that the stream belongs to 'acc'
    stream, err := acc.lookupStream(streamName)
    // ...
}

Patched Code (v2.10.27 / 2.11.1): The fix adds an explicit ownership check before performing destructive operations:

func (s *Server) jsStreamDeleteRequest(sub *subscription, c *client, subject, reply string, msg []byte) {
    // ... parse request ...
    if !s.JetStreamEnabled() || !s.JetStreamAllowDelete(acc) {
        return
    }
    stream, err := acc.lookupStream(streamName)
    if err != nil {
        // ...
        return
    }
    // Ownership check added
    if stream.account() != acc {
        s.Warnf("Unauthorized attempt to delete stream %q from account %q", streamName, acc.Name)
        return
    }
    // ... proceed with deletion ...
}

The patch ensures that the stream's owning account matches the requester's account. Similar checks are applied to purge, consumer delete, and stream update operations.

Exploitation & Lab Setup

Red Team (Attacker Simulation)

Prerequisites:

• A NATS-Server instance (v2.2.0 to v2.10.26 or v2.11.0) with JetStream enabled and at least two accounts configured.
• A valid NATS client connection with JetStream management permissions in any account (e.g., account "A").
• Knowledge of a stream name in another account (e.g., account "B").

Exploitation Steps:

1. Connect to the NATS server using a client with permissions for account "A".
2. Send a JetStream delete request targeting a stream in account "B".

# Using nats CLI (v2.10+)
nats stream delete --force STREAM_IN_ACCOUNT_B

Or programmatically using Go:

nc, _ := nats.Connect("nats://localhost:4222")
js, _ := nc.JetStream()
// This will succeed even if the stream belongs to another account
js.DeleteStream("STREAM_IN_ACCOUNT_B")

3. Verify deletion by attempting to get stream info (which will fail, confirming destruction).

Impact: The attacker can delete or purge any stream in any account, causing data loss and denial of service.

Blue Team (Defense & Detection)

Detection:

• Monitor JetStream API requests for cross-account operations. Log all $JS.API.STREAM.DELETE, $JS.API.STREAM.PURGE, and $JS.API.CONSUMER.DELETE requests.
• Alert on any delete/purge operation where the requesting account does not own the target stream.

Mitigation:

• Immediately upgrade to v2.10.27 or v2.11.1.
• If patching is not possible, restrict JetStream management permissions to only trusted accounts.
• Use network segmentation to limit access to the NATS server.
• Enable audit logging and monitor for unusual JetStream API activity.

Honeypot:

• Create a fake stream named "critical-data" in a low-privilege account and monitor for delete attempts.

Indicators of Compromise (IOCs)

• Network: Unusual JetStream API requests to $JS.API.STREAM.DELETE.*, $JS.API.STREAM.PURGE.*, or $JS.API.CONSUMER.DELETE.* from accounts that do not own the target stream.
• Logs: NATS server logs containing messages like "Unauthorized attempt to delete stream" (only present in patched versions; absence of such logs does not indicate safety).
• System: Sudden disappearance of JetStream streams or consumers without authorized action.
• File: No specific file-based IOCs; the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2025_30215_JetStream_Delete {
    meta:
        description = "Detects JetStream delete API requests that may indicate exploitation of CVE-2025-30215"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30215"
    strings:
        $delete = "$JS.API.STREAM.DELETE." ascii wide nocase
        $purge = "$JS.API.STREAM.PURGE." ascii wide nocase
        $consumer_delete = "$JS.API.CONSUMER.DELETE." ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: JetStream Cross-Account Delete Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-30215 by monitoring JetStream delete API calls from unauthorized accounts.
author: Valters IT
date: 2025-04-01
logsource:
    category: application
    product: nats
detection:
    selection:
        EventID: 5000  # Example NATS audit event ID
        Subject: "$JS.API.STREAM.DELETE.*"
    condition: selection
falsepositives:
    - Legitimate administrative actions from authorized accounts
level: high

Suricata Rule

alert tcp any any -> any 4222 (msg:"CVE-2025-30215 JetStream Cross-Account Delete Attempt"; content:"$JS.API.STREAM.DELETE."; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade NATS-Server to v2.10.27 or v2.11.1 immediately. This is the only complete fix.
2. Workaround: If patching is delayed, disable JetStream management permissions for untrusted accounts. Use the permissions configuration to restrict $JS.API.STREAM.DELETE.* and similar subjects to only authorized accounts.
3. Network: Restrict access to the NATS server (port 4222) to trusted IP ranges only.

Long-Term Measures:

• Implement the principle of least privilege for all NATS accounts.
• Enable and monitor NATS audit logs for all JetStream API operations.
• Regularly review account permissions and stream ownership.
• Use a Web Application Firewall (WAF) or API gateway to inspect JetStream API calls if exposed externally.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Set up alerts for any JetStream delete/purge operations that originate from unexpected accounts.

Valters IT