Authentication bypass via inconsistent skip-auth path interpretation
Résumé
Impact
OAuth2 Proxy is vulnerable to an authentication bypass when path-based
authentication exemptions (--skip-auth-route or --skip-auth-regex) are
configured and a downstream proxy or application interprets the request path
differently from OAuth2 Proxy.
An unauthenticated attacke...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
OAuth2 Proxyでは、認証除外のパス設定と後段のプロキシやアプリケーションでのパスの解釈が食い違うと、未認証の攻撃者が保護されたリソースにアクセスできる脆弱性があります。影響を受けるのは特定の設定を使う環境で、深刻度は重大(CVSS 9.1)です。修正版の情報は確認できていないため、最新の情報を確認してください。
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
OAuth2 Proxy is vulnerable to an authentication bypass when path-based
authentication exemptions (--skip-auth-route or --skip-auth-regex) are
configured and a downstream proxy or application interprets the request path
differently from OAuth2 Proxy.
An unauthenticated attacker can submit a specially crafted path that matches
a public-route exemption but is routed downstream to a protected resource.
Depending on the application, this can expose confidential information or
allow unauthorized access.
The affected path interpretations include:
| Path interpretation | Example | Impacted configurations |
|---|---|---|
| Dot segments | /public/%2e%2e/protected matches a public prefix but resolves downstream to /protected. |
External-auth integrations that forward the original URI; direct proxying with proxyRawPath: true and a downstream component that resolves dot segments. |
| Leading double slashes | //protected/public is parsed as an authority and the path /public, allowing an exact ^/public$ exemption to match. |
External-auth integrations whose downstream routing retains the first component as part of the path. |
| Servlet matrix parameters | /public/..;/protected matches a public prefix but resolves downstream to /protected after matrix parameters are removed. |
Direct proxying or external auth with a downstream component using the affected servlet-style routing semantics. Direct proxying does not require proxyRawPath: true. |
- Dep…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY oauth2-proxy/oauth2-proxy