Authentication Header Spoofing in OpenShift OAuth Proxy

Executive Summary

A flaw in openshift/oauth-proxy allows identity impersonation in upstream applications. The proxy sets authenticated identity headers using dash-variant keys like X-Forwarded-User but fails to remove underscore-variant keys like X_Forwarded_User from requests. WSGI and PHP frameworks treat both variants as the same variable, letting an attacker inject a forged identity header to override the legitimate user's identity.

Useful 0 Not Useful 0

Detection Guidance

Check for presence of underscore-variant headers like X_Forwarded_User in incoming requests to your WSGI or PHP applications. Inspect proxy logs for unusual header patterns or identity overrides. Use tools like tcpdump or Wireshark to monitor HTTP headers for underscore-prefixed variants.

Useful 0 Not Useful 0

Impact Analysis

A low-privilege authenticated user could impersonate higher-privilege identities in upstream applications. This could allow unauthorized access to sensitive data or functions, potentially leading to privilege escalation or data breaches in systems relying on the proxy for authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements for GDPR and HIPAA. It undermines authentication controls, potentially resulting in data breaches and non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest version of openshift/oauth-proxy if available. Configure your proxy to strip underscore-variant headers from client requests. Implement strict header validation in your upstream applications to reject underscore-prefixed headers.

Useful 0 Not Useful 0