Description
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vanus-labs | vanus | 0.8.0 – ≤ 0.9.0 | — |
References
- https://github.com/vanus-labs/vanus/issues/647 issue-tracking
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/gateway.go#L81-L124 technical-description
- VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver third-party-advisory