Skip to content

Latest commit

 

History

History
90 lines (79 loc) · 5.15 KB

attack-surface.md

File metadata and controls

90 lines (79 loc) · 5.15 KB

Attack Surface Analysis for nsqio/nsq

Attack Surface: Unauthorized Message Injection

  • Description: Attackers inject malicious messages into NSQ topics.
  • How NSQ Contributes: NSQ's core function is message passing. Without proper application-level controls, it inherently allows any connected client to publish messages.
  • Example: An attacker sends a message containing a specially crafted payload designed to exploit a vulnerability in a consuming application.
  • Impact:
    • Remote Code Execution (RCE) in consuming applications.
    • Data corruption or modification.
    • Denial of Service (DoS) of consuming applications.
    • Information disclosure.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Application-Level Authentication & Authorization: Implement robust authentication and authorization within the application logic. Producers should include authentication tokens (e.g., JWTs) in messages. Consumers must validate these tokens. This is the primary defense, and is application-level, but is required due to NSQ's design.
    • Input Validation: Consumers must rigorously validate and sanitize all data received from NSQ. This is application-level, but required due to NSQ's design.
    • Message Schema Validation: Define and enforce a strict message schema. This is application-level, but required due to NSQ's design.
    • Network Segmentation: Isolate NSQ.
    • TLS Encryption: Use TLS.

Attack Surface: Denial of Service (DoS) against nsqd

  • Description: Attackers overwhelm nsqd with connections, messages, or slow requests.
  • How NSQ Contributes: nsqd is a network service that accepts connections and processes messages. It has finite resources.
  • Example:
    • Connection Flood.
    • Message Flood.
    • Slowloris.
    • Large Message Attack.
  • Impact:
    • Inability for producers to publish messages.
    • Inability for consumers to receive messages.
    • System instability.
  • Risk Severity: High
  • Mitigation Strategies:
    • Rate Limiting: Implement rate limiting.
    • Connection Limits: Use nsqd's --max-connections.
    • Message Size Limits: Use nsqd's --max-msg-size.
    • Resource Monitoring: Monitor nsqd's resource usage.
    • Network Segmentation: Isolate nsqd.
    • Firewall Rules: Control access to nsqd's TCP port.
    • DDoS Protection: Consider a DDoS mitigation service.

Attack Surface: Unauthorized Access to nsqd and nsqlookupd HTTP Interfaces

  • Description: Attackers gain access to the administrative HTTP interfaces.
  • How NSQ Contributes: nsqd and nsqlookupd expose HTTP interfaces for monitoring and administration.
  • Example: An attacker accesses the /stats endpoint without authentication. Or, an attacker uses an exposed nsqlookupd endpoint to deregister a legitimate nsqd.
  • Impact:
    • Information disclosure.
    • Denial of Service.
    • Configuration manipulation.
  • Risk Severity: High
  • Mitigation Strategies:
    • Network Restrictions: Restrict access using --http-address and firewall rules.
    • Authentication (Proxy): Implement authentication using a reverse proxy.
    • Disable Unnecessary Endpoints: Disable or block unneeded endpoints.
    • TLS Encryption: Use TLS.

Attack Surface: Unauthorized Access to nsqadmin

  • Description: Attackers gain access to the nsqadmin web UI.
  • How NSQ Contributes: nsqadmin provides a centralized web interface for managing the NSQ cluster.
  • Example: An attacker accesses nsqadmin without authentication and deletes a topic.
  • Impact:
    • Information disclosure.
    • Denial of Service.
    • Data loss.
  • Risk Severity: High
  • Mitigation Strategies:
    • Authentication: Require authentication for access.
    • CSRF Protection: Implement CSRF protection.
    • Network Segmentation: Run nsqadmin on a restricted network.
    • TLS Encryption: Use TLS.
    • Strong Passwords: Enforce strong password policies.

Attack Surface: Man-in-the-Middle (MitM) Attacks (Without TLS)

  • Description: Attackers intercept and potentially modify communication between NSQ components.
  • How NSQ Contributes: NSQ relies on network communication. Without encryption, this communication is vulnerable.
  • Example: An attacker captures messages, exposing sensitive data.
  • Impact:
    • Information disclosure.
    • Message tampering.
    • Disruption of message flow.
  • Risk Severity: High
  • Mitigation Strategies:
    • TLS Encryption: Use TLS for all communication within the NSQ cluster.
    • Certificate Verification: Ensure proper TLS certificate verification.