Authentication bypass via spoofed client-IP headers

Impact

OAuth2 Proxy's optional trusted-IP authentication exemption can be bypassed by
spoofing client-IP headers. An unauthenticated remote attacker can cause their
request to be treated as coming from an IP address configured in --trusted-ip,
bypassing OAuth2 Proxy authentication on protected routes, including access
authorized through the auth-only endpoint.

Affected deployments have both --trusted-ip (or trusted_ips) configured and
--reverse-proxy=true (or reverse_proxy=true), and allow an attacker-controlled
client-IP header to reach OAuth2 Proxy. There are two related issues:

• Missing transport-peer trust: The trusted-IP authorization decision
  accepts the configured --real-client-ip-header without first verifying that
  the connecting peer is a trusted proxy. An attacker who can reach OAuth2 Proxy
  directly, or through a proxy that passes through that header, can supply an
  exempt address. Configuring --trusted-proxy-ip, where available, does not
  by itself protect this authorization path.
• Incorrect X-Forwarded-For chain: When
  --real-client-ip-header=X-Forwarded-For is configured, OAuth2 Proxy selects
  the leftmost address. An attacker-supplied exempt address can remain leftmost
  when a legitimate proxy appends the actual client address. This can be
  exploited even when direct access to OAuth2 Proxy is blocked.

Successful exploitation grants a hacker full access normally available through
the IP exemption. Deployments without…