fkie_cve-2025-64484
Vulnerability from fkie_nvd
Published
2025-11-10 22:15
Modified
2025-11-12 16:19
Severity ?
Summary
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way."
},
{
"lang": "es",
"value": "OAuth2-Proxy es una herramienta de c\u00f3digo abierto que puede funcionar como un proxy inverso independiente o como un componente de middleware integrado en configuraciones de proxy inverso o balanceador de carga existentes. En versiones anteriores a la 7.13.0, todas las implementaciones de OAuth2 Proxy delante de aplicaciones que normalizan los guiones bajos a guiones en los encabezados HTTP (por ejemplo, frameworks basados en WSGI como Django, Flask, FastAPI y aplicaciones PHP). Los usuarios autenticados pueden inyectar variantes con guion bajo de los encabezados X-Forwarded-* que eluden la l\u00f3gica de filtrado del proxy, lo que podr\u00eda escalar privilegios en la aplicaci\u00f3n upstream. La autenticaci\u00f3n/autorizaci\u00f3n de OAuth2 Proxy en s\u00ed misma no est\u00e1 comprometida. El problema ha sido parcheado con la v7.13.0. Por defecto, todos los encabezados especificados ahora ser\u00e1n normalizados, lo que significa que tanto la capitalizaci\u00f3n como el uso de guiones bajos (_) frente a guiones (-) ser\u00e1n ignorados al hacer coincidir los encabezados a eliminar. Por ejemplo, tanto \u0027X-Forwarded-For\u0027 como \u0027X_Forwarded-for\u0027 ahora ser\u00e1n tratados como equivalentes y eliminados. Para aquellos que tienen una raz\u00f3n que requiere mantener un encabezado de apariencia similar y no eliminarlo, los mantenedores introdujeron un nuevo campo de configuraci\u00f3n para los encabezados gestionados a trav\u00e9s de AlphaConfig llamado \u0027InsecureSkipHeaderNormalization\u0027. Como soluci\u00f3n alternativa, aseg\u00farese de que la l\u00f3gica de filtrado y procesamiento en los servicios upstream no trate los guiones bajos y los guiones en los encabezados de la misma manera."
}
],
"id": "CVE-2025-64484",
"lastModified": "2025-11-12T16:19:59.103",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 4.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2025-11-10T22:15:37.490",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2"
},
{
"source": "security-advisories@github.com",
"url": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6"
},
{
"source": "security-advisories@github.com",
"url": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html"
},
{
"source": "security-advisories@github.com",
"url": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-644"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…