Listen to this Post
The vulnerability resides in the OPA-Envoy Plugin’s construction of the `input.parsed_path` field. When the plugin parses an HTTP request path, it follows URI standards (RFC 3986) which interpret a double slash (//) at the beginning of a path segment as an authority indicator (like https://`). Consequently, the plugin drops this segment entirely from the `input.parsed_path` array used for authorization policies. For example, a request to `//admin/users` results in a `parsed_path` of[“users”]. However, the raw path (input.attributes.request.http.path) remains//admin/users. Most backend servers (like those behind Envoy) apply lenient normalization, converting `//admin/users` to `/admin/users` before processing. This discrepancy creates a dangerous mismatch: the authorization policy sees a request for `/users` and grants permission, while the backend server receives and processes a request for the protected `/admin/users` resource. This allows an attacker to bypass access controls completely by simply prefixing the target path with double slashes.
<h2 style="color: blue;">dailycve form:</h2>
Platform: OPA Envoy Plugin
Version: before v1.13.2-envoy-2
Vulnerability : Authorization Bypass
Severity: Critical
date: 2024-10-10
<h2 style="color: blue;">Prediction: Patches already available.</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics</h2>
This vulnerability exploits the gap between RFC-compliant parsing and real-world implementation. The core issue is that the authorization layer (OPA) strictly follows the URI spec, dropping the authority segment, while the backend application server typically normalizes the path by merging slashes. This inconsistency allows a simple path confusion attack using `//` to escalate privileges on path-hierarchical resources.
<h2 style="color: blue;">Exploit:</h2>
An attacker can bypass authorization for protected endpoints by sending a crafted HTTP request.
Attempt to access admin panel without privileges curl https://example.com/admin/users Expected: 403 Forbidden Bypass using double-slash technique curl https://example.com//admin/users Result: 200 OK (if vulnerable)
<h2 style="color: blue;">Protection</h2>
Immediate mitigation involves either upgrading the OPA-Envoy plugin or applying configuration changes in Envoy.
<h2 style="color: blue;">1. Upgrade (Permanent Fix):</h2>
<h2 style="color: blue;">Update to the patched version.</h2>
For Docker deployments docker pull openpolicyagent/opa-envoy-plugin:1.13.2-envoy-2 For Go deployments go get github.com/open-policy-agent/[email protected]
<h2 style="color: blue;">2. Envoy Configuration (Workaround):</h2>
Enable the `merge_slashes` option in the Envoy HTTP Connection Manager to normalize the path before OPA evaluates it .
Envoy Configuration Snippet http_filters: - name: envoy.filters.http.rbac typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC rules: ... - name: envoy.filters.http.router Add path normalization options to the HttpConnectionManager route_config: name: local_route virtual_hosts: - name: backend domains: [""] routes: ... http_protocol_options: This is the key setting to mitigate the issue merge_slashes: true
<h2 style="color: blue;">3. Policy Update (Workaround):</h2>
Modify OPA policies to use the raw path (input.attributes.request.http.path) instead of the parsed version. Perform manual parsing within the policy to ensure consistency.
Original vulnerable policy
package example.authz
default allow = false
allow {
input.parsed_path[bash] == "users"
}
Mitigated policy using raw path
package example.authz
default allow = false
Manually parse the raw path
raw_path = input.attributes.request.http.path
clean_path = trim_left(raw_path, "/")
path_segments = split(clean_path, "/")
allow {
Use path_segments instead of input.parsed_path for decisions
path_segments[bash] == "users"
}
<h2 style="color: blue;">Impact</h2>
<h2 style="color: blue;">This vulnerability severely impacts systems where:</h2>
1. Protected resources are path-hierarchical, distinguishing between paths like `/admin/users` and/public/users`.
2. Authorization policies rely on `input.parsed_path` for making access decisions.
3. Backend servers apply lenient path normalization (merging slashes), which is common in most web servers and applications.
Under these conditions, an unauthenticated or low-privileged attacker can trivially bypass access controls to reach administrative endpoints, leading to privilege escalation and potential full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
