-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an authentication bypass in the skip_auth_routes feature of oauth2-proxy. The root cause is that the regular expression matching for the skip routes was performed against the full request URI, including query parameters, instead of just the URL path. This flaw is located in the isAllowedPath function in oauthproxy.go, which used the requestutil.GetRequestURI function to get the string for matching. An attacker could exploit this by sending a request to a protected endpoint and adding a query string that matches a configured skip_auth_routes pattern. For instance, if ^/public/.* was configured as a skip route, a request to /protected_endpoint?param=/public/page would incorrectly match the rule and bypass authentication. The patch addresses this by introducing a new function, requestutil.GetRequestPath, which strips query parameters from the URI before the regex matching occurs in isAllowedPath. The analysis of the patch clearly points to isAllowedPath as the location of the flawed logic and util.GetRequestURI as the source of the unsanitized input that enables the bypass.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/oauth2-proxy/oauth2-proxy/v7 | go | <= 7.10.0 | 7.11.0 |