Описание
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowing the request method to be rewritten to an arbitrary attacker-supplied value before routing. This bypasses method-based access controls enforced by upstream proxies or Web Application Firewalls (WAFs), potentially leading to unauthorized actions or information disclosure.
Меры по смягчению последствий
To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the X-HTTP-Method-Override header from incoming requests before they are forwarded to grpc-gateway applications. This prevents the grpc-gateway from processing the malicious header and bypassing access controls.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-hub-rhel9 | Affected | ||
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-plugin-event-sender-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/logic-rhel9-operator | Affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-must-gather-rhel9 | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/observatorium-rhel9 | Affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/prometheus-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform/platform-operator-bundle | Not affected |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The ap ...
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
5.4 Medium
CVSS3