F5-K000162611: High severity F5 NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Ingress Controller when configured with the ExternalAuth policy or with Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX authrequest directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of F5 NGINX Ingress Controller are exposed when they use the ExternalAuth policy or Ingress external authentication. The issue concerns request attributes forwarded to the external authentication subrequest.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker can exploit the issue by supplying spoofed X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, or X-Forwarded-Method headers. No privileges or user interaction are required.
What is the likely impact?
The attacker may cause the external authentication provider to evaluate spoofed request routing or method attributes, resulting in an authentication and authorization bypass. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.