Weak Header Parsing in Capgo Allows API Key Bypass

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves a weak parsing issue in the x-limited-key-id header.

Attackers can submit malformed, zero, or duplicate x-limited-key-id headers that cause the system to interpret these values as NaN (Not a Number) or falsy.

This allows remote attackers to bypass subkey enforcement, effectively disabling limited key scoping.

As a result, attackers can execute requests using the main API key context instead of the restricted permissions intended by subkeys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass security restrictions imposed by subkey permissions.

By exploiting the weak parsing of the x-limited-key-id header, attackers can gain unauthorized access to perform actions with the full privileges of the main API key.

This can lead to unauthorized operations, potential data exposure, or manipulation within systems using Capgo.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for requests containing the x-limited-key-id header with malformed values such as non-integer strings, zero, or duplicate headers.

Proof-of-concept requests that send values like "73603x", "0", or duplicate x-limited-key-id headers result in bypassing subkey enforcement and returning HTTP 200 responses.

To detect exploitation attempts, you can use network inspection tools or command-line utilities like curl to send test requests with malformed x-limited-key-id headers and observe if the system improperly allows access.

• Example curl command to test for vulnerability: curl -H "x-limited-key-id: 0" https://your-capgo-endpoint/app
• Example curl command with duplicate headers: curl -H "x-limited-key-id: 123" -H "x-limited-key-id: 456" https://your-capgo-endpoint/app

If these requests succeed in bypassing subkey restrictions, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying strict validation on the x-limited-key-id header to reject non-integer strings, zero, negative values, NaN, and comma-separated lists.

Specifically, use validation methods such as Number.isSafeInteger and regex patterns like /^[1-9]\d*$/ to ensure only valid positive integers are accepted.

Replace any truthy checks on the header value with explicit null or invalid value checks to prevent silent bypasses.

Implement a defense-in-depth approach by adding functions like validateSubkeyUser to ensure consistency between subkey and user context.

Upgrade Capgo to version 12.128.2 or later where this vulnerability has been fixed.

Useful 0 Not Useful 0