Listen to this Post
The vulnerability in Better Auth occurs when the baseURL is not explicitly configured, such as when the BETTER_AUTH_URL environment variable is missing. Upon server startup, if no baseURL is defined, the application falls back to deriving baseURL from the first incoming request’s headers. Specifically, it implicitly trusts the X-Forwarded-Host and X-Forwarded-Proto headers to construct the baseURL. An attacker can send a malicious first request with crafted values in these headers, poisoning the calculated baseURL. This poisoned baseURL leads to an incorrect basePath being set in the router. Once the basePath is poisoned, the router fails to match any incoming request paths, causing all subsequent requests to return HTTP 404 errors for all users. The poisoning persists until the server is restarted, and the vulnerability is only exploitable if the attacker can ensure their request is the first after startup and the server lacks explicit baseURL configuration.
Platform: Better Auth
Version: Unconfigured instances
Vulnerability: BaseURL poisoning
Severity: Medium
date: Unknown
Prediction: Patch date unknown
What Undercode Say:
Analytics
curl -i –location ‘https://example.com/api/auth/ok’ –header ‘X-Forwarded-Proto: some:’ –header ‘X-Forwarded-Host: junk’
curl -i –location ‘https://example.com/api/auth/ok’
How Exploit
Send poisoned headers first.
Protection from this CVE
Explicitly configure baseURL.
Impact
Persistent 404 errors.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
