1 line
4.3 KiB
JSON
1 line
4.3 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-2hp7-65r3-wv54","published":"2026-04-22T22:03:43Z","modified":"2026-05-20T19:41:02.281478581Z","aliases":["CVE-2026-42072","GO-2026-4967"],"summary":"NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access","details":"## Summary\n\nThe `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.\n\nOn a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.\n\n## Version\n\n- `nornicdb v1.0.39`\n- Built from commit `afe7c9d` on `main`\n- Platform: macOS (darwin 25.4.0, arm64)\n\n## Reproduction\n\n```\n$ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ...\n```\n\nOutput claims Bolt is on localhost:\n```\nBolt server listening on bolt://localhost:7687\n```\n\nBut the actual socket:\n```\n$ netstat -an -p tcp | grep 7687\ntcp46 0 0 *.7687 *.* LISTEN\n\n$ lsof -iTCP:7687 -sTCP:LISTEN -n -P\nnornicdb ... IPv6 ... TCP *:7687 (LISTEN)\n```\n\nHTTP port is correctly bound:\n```\ntcp4 127.0.0.1.7474 *.* LISTEN\n```\n\nReachable from another host on the LAN:\n```\n$ nc -z 192.168.x.y 7687\nConnection to 192.168.x.y port 7687 [tcp/*] succeeded!\n```\n\nSetting `NORNICDB_BOLT_ADDRESS=127.0.0.1` or `server.host: \"127.0.0.1\"` in `config.yaml` has **no effect** on the Bolt listener.\n\n## Root Cause\n\nIn `pkg/bolt/server.go:774-776`:\n\n```go\nfunc (s *Server) ListenAndServe() error {\n addr := fmt.Sprintf(\":%d\", s.config.Port)\n listener, err := net.Listen(\"tcp\", addr)\n ...\n}\n```\n\n`bolt.Config` (line 474) has no `Host`/`Address`/`Addr` field — only `Port`. The CLI flag `--address` is stored in a local variable in `cmd/nornicdb/main.go:80` and used to format user-facing log output (line 637–644), but is never copied into `boltConfig` at line 600–609 when Bolt is initialized.\n\nSince `ListenAndServe` calls `net.Listen(\"tcp\", \":7687\")` with an empty host, Go binds the wildcard socket on all interfaces.\n\n## Suggested Fix\n\n1. Add a `Host string` field to `bolt.Config` (default `\"127.0.0.1\"`, matching the CLI flag default).\n2. In `cmd/nornicdb/main.go` around line 601, wire it through:\n ```go\n boltConfig.Host = address\n boltConfig.Port = boltPort\n ```\n3. In `pkg/bolt/server.go:775`, use the host:\n ```go\n addr := net.JoinHostPort(s.config.Host, strconv.Itoa(s.config.Port))\n ```\n\n## Security Impact\n\n- Default `admin:password` credentials + wildcard binding = anyone on the same WiFi can issue arbitrary Cypher queries (read, write, delete nodes) against NornicDB instances running with default setup.\n- Users following the README will reasonably assume `--address 127.0.0.1` (the documented default) binds *both* protocols to localhost.\n- Workaround: host-firewall rules (e.g. macOS `pf`) blocking non-loopback → 7687. Not discoverable from the docs.","affected":[{"package":{"name":"github.com/orneryd/nornicdb","ecosystem":"Go","purl":"pkg:golang/github.com/orneryd/nornicdb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.42-hotfix"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2hp7-65r3-wv54/GHSA-2hp7-65r3-wv54.json"}}],"references":[{"type":"WEB","url":"https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42072"},{"type":"WEB","url":"https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca"},{"type":"PACKAGE","url":"https://github.com/orneryd/NornicDB"},{"type":"WEB","url":"https://github.com/orneryd/NornicDB/releases/tag/v1.0.42"},{"type":"WEB","url":"https://github.com/orneryd/NornicDB/releases/tag/v1.0.42-hotfix"}],"database_specific":{"cwe_ids":["CWE-1392"],"github_reviewed":true,"github_reviewed_at":"2026-04-22T22:03:43Z","nvd_published_at":"2026-05-08T17:16:31Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]} |