REDHAT-BUG-2460449: High severity oauth2-proxy OAuth2 Proxy vulnerability
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-regex or --skip-auth-route is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with --reverse-proxy enabled and configure at least one --skip-auth-regex or --skip-auth-route rule. This issue is patched in v7.15.2. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided X-Forwarded-Uri header at the reverse proxy or load balancer level; explicitly overwrite X-Forwarded-Uri with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow --skip-auth-regex / --skip-auth-route rules where possible. For nginx-based deployments, ensure X-Forwarded-Uri is set by nginx and not passed through from the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v7.15.2 - Configuration
Ensure nginx sets X-Forwarded-Uri based on the request it received and strips/removes any client-provided X-Forwarded-Uri so it is not passed through to oauth2-proxy.
nginx (fronting OAuth2 Proxy) X-Forwarded-Uri = set by nginx to the actual request URI (do not pass client-provided header) - Configuration
Where possible, remove or narrow --skip-auth-regex and/or --skip-auth-route rules to reduce/eliminate paths that would be evaluated using an attacker-controlled (spoofed) X-Forwarded-Uri while running versions affected by the issue (7.5.0 through 7.15.1) with --reverse-proxy enabled.
OAuth2 Proxy (reverse proxy usage) --skip-auth-regex / --skip-auth-route = remove or narrow any configured skip-auth rules - Compensating control
Restrict direct client access to oauth2-proxy so it can only be reached through a trusted reverse proxy / load balancer (e.g., block public access and allow only the trusted upstream proxy).