Malcolm nginx Lua RBAC Bypass via Percent-Encoded URI

Executive Summary

This vulnerability involves Malcolm's nginx Lua RBAC layer checking percent-encoded URIs for access control while nginx itself uses decoded URIs to route requests. An authenticated low-privilege user can bypass restrictions by using percent-encoding in the request path (e.g., /%68tadmin.php) to access admin-only locations.

Useful 0 Not Useful 0

Detection Guidance

Check nginx access logs for percent-encoded paths like /%68tadmin.php or similar variations. Look for requests to admin-only paths with unusual encodings. Inspect Lua RBAC logs for mismatches between requested and decoded URIs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could gain unauthorized access to restricted admin paths, potentially exposing sensitive data or performing privileged actions. This could lead to data breaches, unauthorized modifications, or system compromise depending on the exposed endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or administrative functions. GDPR and HIPAA mandate strict access controls and data protection; such a bypass undermines these controls, potentially leading to regulatory penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update Malcolm's nginx Lua RBAC to decode percent-encoded URIs before path matching. Restrict access to admin-only paths at the nginx configuration level. Review and tighten URI pattern matching rules to prevent bypass attempts.

Useful 0 Not Useful 0