Authorization Bypass in Elixir GRPC via Path-Bound Field Manipulation

Compliance Impact

This vulnerability allows authenticated attackers to bypass authorization checks and access or modify resources belonging to other users by manipulating path-bound fields. Such unauthorized access to user data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information.

Because the vulnerability enables unauthorized data access and modification, it undermines the confidentiality and integrity requirements mandated by these standards, potentially resulting in non-compliance and associated legal or regulatory consequences.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key issue in the elixir-grpc grpc library. Authenticated attackers can exploit it by sending a conflicting value for any path-bound field via the query string or request body. Due to the way the server merges path bindings with user-supplied data, the attacker-supplied value can override the intended path-bound value.

Specifically, in the Elixir.GRPC.Server.Transcode module, the use of Map.merge/2 with path bindings as the first argument causes the attacker-controlled data to take precedence. This allows attackers to bypass authorization, multi-tenancy scoping, or ownership checks that rely on these path-bound fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker to access or modify resources that belong to other users without proper authorization. This means sensitive data or functionality intended only for certain users could be exposed or altered by unauthorized parties.

Such unauthorized access can lead to data breaches, loss of data integrity, and potential compromise of user privacy or system security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests that include query string or request body parameters which override path-bound fields, such as user identifiers. For example, requests like GET /users/me/profile?user_id=victim indicate an attempt to manipulate path parameters.

To detect such attempts on your system, you can inspect HTTP logs or use network monitoring tools to filter requests where query parameters or body fields conflict with path parameters.

Suggested commands include using tools like curl or tcpdump to capture and analyze traffic, and grep or jq to search logs for suspicious query strings or body content overriding path parameters.

• Use curl to simulate suspicious requests: curl -v "http://yourserver/users/me/profile?user_id=victim"
• Use grep to search server logs for query parameters overriding path fields: grep -E "user_id=" /var/log/yourapp/access.log
• Use tcpdump or Wireshark to capture HTTP traffic and filter for requests with query strings or bodies containing conflicting user IDs.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling HTTP-to-gRPC transcoding if it is enabled, as the vulnerability is exploitable only when this feature is active.

If disabling transcoding is not feasible, carefully audit and modify your authorization logic to ensure that path-bound fields cannot be overridden by query string or request body parameters.

Monitor and block suspicious requests that attempt to override path parameters by filtering or rate-limiting such traffic.

Apply the patch from commit 33b6a095dbc91c6dee3c7b90893d7d74952e82e4 once it is available in your version of the grpc library, which fixes the merge precedence issue.

Useful 0 Not Useful 0