tinyauth Rule Bypass via Unanchored Regex

Executive Summary

tinyauth before 5.1.3 has an authentication bypass flaw where unanchored regular expressions allow rule circumvention. Attackers can append allowed route strings to bypass authentication by exploiting path matching that ignores boundaries. For example, a rule for /health could match /admin?x=/health due to unanchored regex and query string inclusion.

Useful 0 Not Useful 0

Detection Guidance

Check tinyauth version with 'tinyauth --version' or inspect installed package metadata. Review configuration files for unanchored regex patterns in path rules. Test for bypass by sending requests with appended allowed paths like '/admin?x=/health' and verify if access is granted without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated users to access protected routes by manipulating URIs or query parameters. Attackers could gain unauthorized access to sensitive data, modify configurations, or perform actions restricted to authenticated users. The impact includes potential data breaches or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade tinyauth to version 5.1.3 or later. Update regex patterns in configuration to use anchored boundaries (^ and $). Normalize X-Forwarded-Uri headers to prevent path manipulation. Restrict network access to tinyauth instances until patched.

Useful 0 Not Useful 0