Malcolm Reverse Proxy URL Path Normalization Bypass via RBAC Bypass

Executive Summary

This vulnerability is an authorization bypass in Malcolm's nginx reverse proxy. It occurs due to a mismatch in URL path normalization between the Lua-based RBAC authorization layer and nginx's request routing logic. An authenticated user can craft a request path with a specially formatted segment like /./ to bypass role-based access restrictions and access administrative endpoints they should not have permission to reach.

Useful 0 Not Useful 0

Detection Guidance

Check nginx access logs for unusual paths containing '/./' segments or requests to restricted endpoints like '/htadmin/', '/upload/', or '/pcap/export'. Use tools like curl to test paths with '/./' prefix to see if unauthorized access is granted.

Useful 0 Not Useful 0

Impact Analysis

An attacker with minimal privileges could gain unauthorized access to sensitive components such as file upload interfaces, account administration UI, or PCAP export endpoints. This could allow file injection or manipulation of evidence in network-monitoring environments if downstream services do not re-check roles.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or administrative functions, potentially violating data protection requirements under GDPR or HIPAA. Unauthorized access to file uploads or evidence manipulation may result in non-compliance with access control and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the normalize_uri_for_rbac() function in nginx_auth_helpers.lua to resolve both '.' and '..' segments. Alternatively, match the normalized URI (ngx.var.uri) or implement a fail-closed policy in nginx configuration.

Useful 0 Not Useful 0