| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/oauth2-proxy/oauth2-proxy | 全バージョン | |
| github.com/oauth2-proxy/oauth2-proxy/v7 | ≥ 7.5.0, < 7.15.2 | 7.15.2 |
| oauth2 proxy | ≥ 7.5.0, < 7.15.2 | 7.15.2 |
A configuration-dependent authentication bypass exists in OAuth2 Proxy.
Deployments are affected when all of the following are true:
--reverse-proxy--skip_auth_routes or the legacy --skip-auth-regexOAuth2 Proxy may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-route or --skip-auth-regex is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.
This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.
This issue is addressed as part of the newly introduced flag in . If you leave it unset, OAuth2 Proxy will source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure.
--trusted-proxy-ipv7.15.2--trusted-proxy-ipX-Forwarded-*Strip any client-provided X-Forwarded-Uri header at the reverse proxy or load balancer level
Explicitly overwrite X-Forwarded-Uri with the actual request URI before forwarding requests to OAuth2 Proxy
Example nginx mitigation for the auth subrequest:
location /internal-auth/ {
internal; # Ensure external users can't access this path
# Make sure the OAuth2 Proxy knows where the original request came from.
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_pass http://oauth2-proxy:4180/;
}
Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy
Remove or narrow --skip-auth-route / --skip-auth-regex rules where possible
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン