[deb-hacktron]

Minimal historical bug recreation for internal review-bot demo with dummy-authored commits.

[hacktron-app-stg]

1 issue found across 1 file

Severity	Count
🔴 High	1

View full scan results

[hacktron-app-stg]

🔴 High: Authentication Bypass via Unanchored Regex in Allowed Routes

The isAllowedRoute function uses unanchored regular expressions to validate request paths against the SkipAuthRoutes allowlist. Because these regular expressions are not anchored to the start of the URI (e.g., using ^), a route configured as /public will match any URI containing the string /public, such as /admin/public or /api/v1/public/../../secret. This allows attackers to bypass authentication for sensitive routes by crafting requests that contain the allowed path string.

Steps to Reproduce

1. Configure OAuth2 Proxy with skip-auth-routes = ["/public"].
2. Observe that requests to /public are allowed without authentication.
3. Send a request to /admin/public.
4. Observe that the request to /admin/public is also allowed without authentication because the regex /public matches anywhere in the URI.

Trace

graph TD
    subgraph SG0 ["./oauth2-proxy/oauthproxy.go"]
        IsAllowedRequest["IsAllowedRequest"]
        isAllowedRoute{{"Evaluates whether a request's method and path match the configured allowlist, permitting access without authentication."}}
        serveHTTP["serveHTTP"]
    end
    style SG0 fill:#2a2a2a,stroke:#444,color:#aaa
    IsAllowedRequest --> isAllowedRoute
    serveHTTP --> IsAllowedRequest

Loading

Fix with AI

Fix the following security vulnerability found by Hacktron.

File: oauthproxy.go
Lines: 703
Severity: high

Vulnerability: Authentication Bypass via Unanchored Regex in Allowed Routes

Description:
The `isAllowedRoute` function uses unanchored regular expressions to validate request paths against the `SkipAuthRoutes` allowlist. Because these regular expressions are not anchored to the start of the URI (e.g., using `^`), a route configured as `/public` will match any URI containing the string `/public`, such as `/admin/public` or `/api/v1/public/../../secret`. This allows attackers to bypass authentication for sensitive routes by crafting requests that contain the allowed path string.

Proof of Concept:
**Steps to Reproduce**

1. Configure OAuth2 Proxy with `skip-auth-routes = ["/public"]`.
2. Observe that requests to `/public` are allowed without authentication.
3. Send a request to `/admin/public`.
4. Observe that the request to `/admin/public` is also allowed without authentication because the regex `/public` matches anywhere in the URI.

Affected Code:
func (p *OAuthProxy) isAllowedRoute(req *http.Request) bool {
	for _, route := range p.allowedRoutes {
		if (route.method == "" || req.Method == route.method) && route.pathRegex.MatchString(util.GetRequestURI(req)) {
			return true
		}
	}
	return false
}

Fix this vulnerability. Only change what's necessary - don't modify unrelated code.

---

Triage: Reply !fp (false positive), !valid (confirmed), or !accepted_risk. Any other reply is saved as a triage note.

View finding in Hacktron

[deb-hacktron]

Refreshing scan with a new PR.