Authentication Bypass in @acastellon/auth via Spoofable Headers

Executive Summary

This vulnerability exists in versions prior to 2.3.0 of the @acastellon/auth package, specifically in the validateToken() function. It allows an unauthenticated attacker to bypass authentication by spoofing the auth-user and Host HTTP request headers.

The validateToken middleware contains a service-to-service bypass that checks if the auth-user header is set to "service-brother" and if the Host header starts with a specific hostname. Both headers are client-controlled and can be manipulated by an attacker.

By sending crafted requests with these spoofed headers, the attacker can bypass token validation before the normal authentication logic (legacy/JWT/OIDC) runs, potentially gaining unauthorized access to protected routes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to bypass authentication controls by spoofing headers, potentially granting unauthorized access to protected routes and leading to privilege escalation in some deployments.

Such unauthorized access could result in exposure or misuse of sensitive data, which may impact compliance with standards and regulations like GDPR or HIPAA that require strict access controls and protection of personal or sensitive information.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote unauthenticated attacker to bypass authentication controls, gaining unauthorized access to protected routes or services.

If downstream services rely on headers like auth-user or is-* for authorization, this flaw could lead to privilege escalation, allowing attackers to perform actions or access data beyond their intended permissions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests that contain suspicious or crafted auth-user and Host headers attempting to bypass authentication.

Specifically, look for requests where the auth-user header is set to "service-brother" and the Host header starts with the service's hostname, as these are indicators of the bypass attempt.

You can use network monitoring or log analysis tools to filter for such requests.

• Using tcpdump or similar tools to capture HTTP traffic and grep for suspicious headers, e.g.:
• tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'auth-user: service-brother'
• Or analyze web server logs for requests with auth-user=service-brother and Host headers starting with your service hostname.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the @acastellon/auth package to version 2.3.0 or later, where the vulnerability has been fixed.

Version 2.3.0 removes the spoofable bypass, sanitizes incoming auth-user and is-* headers, and implements mutual TLS (mTLS) client certificate authentication for enhanced security.

Until the upgrade can be applied, consider implementing network-level filtering to block requests with suspicious auth-user and Host headers that could exploit this bypass.

Useful 0 Not Useful 0