Nomad Event Stream Subscriber Using ACL Token with TTL Receive Updates Until Garbage Collected

[tgross]

Bulletin ID: HCSEC-2022-26
Bulletin Title: Nomad Event Stream Subscriber Using ACL Token with TTL Receive Updates Until Garbage Collected

Publication Date: October 27, 2022

Affected Products / Versions: Nomad and Nomad Enterprise 1.4.0 up to 1.4.1; fixed in 1.4.2.

Summary:
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that an event stream subscriber using an ACL token with an expiry TTL set would continue to receive events until the token was garbage collected. This vulnerability, with CVE assignment pending, was fixed in Nomad 1.4.2.

Background:
Nomad’s event stream provides a way to subscribe to Job, Allocation, Evaluation, Deployment, and Node changes in near real time. Whenever a state change occurs in Nomad's Finite State Machine (FSM) a set of events for each updated object are created.

Details:
During internal testing it was observed that an ACL token with an expiry TTL set would continue to receive events until the token was garbage collected. This behavior may be used by a malicious operator or third party with authenticated access to continue to receive events beyond the time limit their token should be allowed to.

Nomad’s ACL token TTL verification logic has been modified to authorize the subscriber’s ACL token before sending each event down the stream.

Remediation:
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.4.2, or newer.

See Nomad’s Upgrading for general guidance on this process.

Acknowledgement:
This issue was identified internally by the Nomad engineering team.

Additional content required for disclosure:

CVE Description:
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

CHANGELOG Entry:
n/a

[tgross]

A request for CVE ID has been issued and this issue will be updated once that's available.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.