Improper Authentication Bypass in Apache bRPC

Executive Summary

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by sending a builtin HTTP request first on the same HTTP/1.1 keep-alive connection. This causes the connection to be treated as authenticated for subsequent requests on that socket.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP/1.1 keep-alive connections where the first request on a socket bypasses authentication. Check if builtin HTTP services are exposed on public listeners with ServerOptions.auth enabled. Inspect logs for unauthenticated access to protected endpoints following a builtin request on the same connection.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access protected HTTP endpoints without proper authentication, potentially gaining unauthorized access to sensitive data or functions. This is especially risky if builtin HTTP services are exposed on a public listener with ServerOptions.auth enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face legal and regulatory penalties due to insufficient authentication controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later to fix the issue. Alternatively, apply the patch from PR #3308 manually. Disable ServerOptions.auth if not required or restrict builtin HTTP services to non-public listeners until patched.

Useful 0 Not Useful 0