Executive Summary

This vulnerability affects Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 when they are configured to listen on an alternate port. The middleware that is supposed to restrict access to these endpoints incorrectly uses the HTTP Host header to determine access instead of the actual network socket port. This allows an attacker to potentially bypass port-based access restrictions by manipulating the Host header.

Versions 3.4.0 and 4.2.0 have patched this issue. If upgrading immediately is not possible, it is recommended to add explicit ASP.NET Core authorization to all sensitive actuator endpoints or configure the reverse proxy/load balancer to enforce the Host header value and prevent clients from setting arbitrary ports.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive management endpoints of Steeltoe applications. Because the middleware relies on the Host header rather than the actual port, an attacker can bypass port-based access controls and potentially gain access to sensitive information or functionality exposed by these endpoints.

The CVSS score of 8.2 indicates a high severity, meaning the impact on confidentiality is high, integrity is low, and availability is not affected. This could result in exposure of sensitive data or partial compromise of the application.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade Steeltoe management endpoints to versions 3.4.0 or 4.2.0 where the issue is patched.

If an immediate upgrade is not possible, apply explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints to add a defense-in-depth layer independent of port isolation.

Additionally, configure your reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

Useful 0 Not Useful 0