Описание
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-regex or --skip-auth-route is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with --reverse-proxy enabled and configure at least one --skip-auth-regex or --skip-auth-route rule. This issue is patched in v7.15.2. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided X-Forwarded-Uri header at the reverse proxy or load balancer level; explicitly overwrite X-Forwarded-Uri with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow --skip-auth-regex / --skip-auth-route rules where possible. For nginx-based deployments, ensure X-Forwarded-Uri is set by nginx and not passed through from the client.
A flaw was found in OAuth2 Proxy. When configured with --reverse-proxy and either --skip-auth-regex or --skip-auth-route, the proxy may trust a client-supplied X-Forwarded-Uri header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass. This allows unauthorized access to protected routes without a valid session.
Отчет
There's an Important flaw in oauth2-proxy software where it trusts a client supplied X-Forwarded-Uri request header. This header is used by oauth2-proxy to identify the original URI from the incoming request it's currently handling. An attacker which manages to spoof the requests sent to it when it's running behind a reverse-proxy may change this header field to match the routes or the regular expressions configured to have authentication skipped, as a consequence the attacker may manage to have access to protected resources or internal routes without any kind of authentication being required resulting in a high impact for data confidentiality and integrity for the services positioned behind the reverse proxy.
Red Hat Product Security team has rated this vulnerability as having a impact of Important as for a oauth2-proxy being considered vulnerable it should be being executed with the following specific configuration options enabled:
--reverse-proxy--skip-auth-regexor--skip-auth-routeAdditionally to exploit this vulnerability the attacker should be able to change the headers in the request being sent (either via a local proxy or by performing a Man-In-The-Middle attack before) and should have previous knowledge about the routes or patterns of URI which the authentication are being skipped by theoauth2-proxydeployment.
Меры по смягчению последствий
This issue can be mitigated by one of the options bellow:
- Strip any client-provided
X-Forwarded-Uriheader at any layer before it reachesoauth2-proxy; - Overwrite the
X-Forwarded-Uriheader with the actual request URI before the request reachesoauth2-proxy. If you are using NGINX you can use the following example to create your tailored mitigation:
- Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy;
- Remove or narrow --skip-auth-route / --skip-auth-regex rules where possible;
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 9 | rhceph/oauth2-proxy-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
8.7 High
CVSS3
Связанные уязвимости
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual reque
OAuth2 Proxy is a reverse proxy that provides authentication using OAu ...
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
8.7 High
CVSS3