authentik prior 2023.4.3/2023.5.5 Header X-Forwarded-For/X-Real-IP interpretation conflict

Summaryinfo

A vulnerability was found in authentik. It has been classified as critical. This issue affects some unknown processing of the component Header Handler. Performing a manipulation of the argument X-Forwarded-For/X-Real-IP results in interpretation conflict. This vulnerability is cataloged as CVE-2023-36456. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in authentik. It has been classified as critical. This affects an unknown code block of the component Header Handler. The manipulation of the argument X-Forwarded-For/X-Real-IP with an unknown input leads to a interpretation conflict vulnerability. CWE is classifying the issue as CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used. This poses a possible security risk when someone has flows or policies that check the user's IP address, e.g. when they want to ignore the user's 2 factor authentication when the user is connected to the company network. A second security risk is that the IP addresses in the logfiles and user sessions are not reliable anymore. Anybody can spoof this address and one cannot verify that the user has logged in from the IP address that is in their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to. Versions 2023.4.3 and 2023.5.5 contain a patch for this issue.

The weakness was shared 07/06/2023 as GHSA-cmxp-jcw7-jjjv. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-36456 since 06/21/2023. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2023.4.3 or 2023.5.5 eliminates this vulnerability. The upgrade is hosted for download at goauthentik.io. Applying the patch 15026748d19d490eb2baf9a9566ead4f805f7dff is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• authentik

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion