Mj Dhurgesh

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

**Name of the Vulnerable Software and Affected Versions** restbed versions prior to 5.0.1 **Description** The software buffers HTTP request headers without enforcing a maximum size limit. This allows remote unauthenticated attackers to exhaust server memory by opening TCP connections and streaming bytes indefinitely without sending the header delimiter, which forces the server to allocate unbounded heap memory until the process is terminated. **Recommendations** Update to a version newer than 5.0.0.

**Name of the Vulnerable Software and Affected Versions** restbed versions prior to 5.0.1 **Description** The software accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. This allows remote unauthenticated attackers to declare large frame sizes and stream payload data to exhaust server memory, resulting in a denial of service through a process crash. **Recommendations** Update to a version newer than 5.0.0.