Executive Summary

This vulnerability affects Authelia versions 4.36.0 through 4.39.19, an open-source authentication and authorization server. Due to a lack of canonicalization of domains in very specific edge cases, an access control rule may be skipped when it should match a request. This can happen under a complex set of conditions involving the use of forwarded authorization integration, specific domain structures with additional segments, multiple inexact domain match rules ordered from most to least specific, and the presence of capitalized letters in certain parts of the requested domain. If these conditions are met, an attacker could bypass access control rules.

The issue arises because the proxy does not canonicalize the requested host name before sending it to the authorization endpoint, allowing a bypass of the intended access control. The vulnerability is fixed in version 4.39.20.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass access control rules in Authelia under very specific conditions. This means that unauthorized users might gain access to resources that should be protected, potentially exposing sensitive information or allowing unauthorized actions within applications secured by Authelia.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Authelia to version 4.39.20 or later, which contains the patch addressing the issue.

Additionally, avoid configurations where hosts that should be bypassed are still checked by the proxy with authorization handlers, as this setup is highly discouraged and can lead to bypasses.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from very specific configuration conditions in Authelia versions 4.36.0 through 4.39.19 involving domain canonicalization and access control rules. Detection involves verifying if your Authelia deployment matches these conditions.

• Check the Authelia version to see if it is between 4.36.0 and 4.39.19.
• Review your access control rules for the presence of two separate rules with inexact domain matches such as '*.b.example.com' and '*.example.com' ordered from most specific to least specific.
• Verify if the requested domains in your logs include domains with two additional segments compared to the session domain, e.g., 'a.b.example.com' vs 'example.com'.
• Check if the proxy or authorization integration does not canonicalize the requested host name before authorization.

Since no specific detection commands or tools are provided in the available information, a general approach is to audit configuration files and logs manually. For example, you can use commands like:

• To check Authelia version: `authelia --version` or check the version in your deployment manifests.
• To search for access control rules in configuration files: `grep -E '\*\.b\.example\.com|\*\.example\.com' /path/to/authelia/configuration.yml`
• To analyze logs for suspicious domain requests with capitalized letters in the second segment: `grep -E 'https://[a-zA-Z]+\.[A-Z][a-zA-Z]*\.example\.com' /path/to/authelia/logs.log`

Upgrading Authelia to version 4.39.20 or later is recommended to patch this vulnerability.

Useful 0 Not Useful 0