Skip to content

fix: use X-Forwarded-Uri if it exists for pathRegex match #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
deb-hacktron wants to merge 1 commit into from
Closed

fix: use X-Forwarded-Uri if it exists for pathRegex match #4

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion oauthproxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -700,7 +700,7 @@ func (p *OAuthProxy) IsAllowedRequest(req *http.Request) bool {
// IsAllowedRoute is used to check if the request method & path is allowed without auth
func (p *OAuthProxy) isAllowedRoute(req *http.Request) bool {
for _, route := range p.allowedRoutes {
if (route.method == "" || req.Method == route.method) && route.pathRegex.MatchString(req.URL.Path) {
if (route.method == "" || req.Method == route.method) && route.pathRegex.MatchString(util.GetRequestURI(req)) {

@hacktron-app-stg hacktron-app-stg Bot Apr 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High: Authentication Bypass via Unanchored Regex in Allowed Routes

The isAllowedRoute function uses unanchored regular expressions to validate request paths against the SkipAuthRoutes allowlist. Because these regular expressions are not anchored to the start of the URI (e.g., using ^), a route configured as /public will match any URI containing the string /public, such as /admin/public or /api/v1/public/../../secret. This allows attackers to bypass authentication for sensitive routes by crafting requests that contain the allowed path string.

Steps to Reproduce
  1. Configure OAuth2 Proxy with skip-auth-routes = ["/public"].
  2. Observe that requests to /public are allowed without authentication.
  3. Send a request to /admin/public.
  4. Observe that the request to /admin/public is also allowed without authentication because the regex /public matches anywhere in the URI.
Trace 
graph TD
    subgraph SG0 ["./oauth2-proxy/oauthproxy.go"]
        IsAllowedRequest["IsAllowedRequest"]
        isAllowedRoute{{"Evaluates whether a request's method and path match the configured allowlist, permitting access without authentication."}}
        serveHTTP["serveHTTP"]
    end
    style SG0 fill:#2a2a2a,stroke:#444,color:#aaa
    IsAllowedRequest --> isAllowedRoute
    serveHTTP --> IsAllowedRequest
Loading
Fix with AI

Open in Cursor Open in Claude

Fix the following security vulnerability found by Hacktron.

File: oauthproxy.go
Lines: 703
Severity: high

Vulnerability: Authentication Bypass via Unanchored Regex in Allowed Routes

Description:
The `isAllowedRoute` function uses unanchored regular expressions to validate request paths against the `SkipAuthRoutes` allowlist. Because these regular expressions are not anchored to the start of the URI (e.g., using `^`), a route configured as `/public` will match any URI containing the string `/public`, such as `/admin/public` or `/api/v1/public/../../secret`. This allows attackers to bypass authentication for sensitive routes by crafting requests that contain the allowed path string.

Proof of Concept:
**Steps to Reproduce**

1. Configure OAuth2 Proxy with `skip-auth-routes = ["/public"]`.
2. Observe that requests to `/public` are allowed without authentication.
3. Send a request to `/admin/public`.
4. Observe that the request to `/admin/public` is also allowed without authentication because the regex `/public` matches anywhere in the URI.

Affected Code:
func (p *OAuthProxy) isAllowedRoute(req *http.Request) bool {
	for _, route := range p.allowedRoutes {
		if (route.method == "" || req.Method == route.method) && route.pathRegex.MatchString(util.GetRequestURI(req)) {
			return true
		}
	}
	return false
}

Fix this vulnerability. Only change what's necessary - don't modify unrelated code.

Triage: Reply !fp (false positive), !valid (confirmed), or !accepted_risk. Any other reply is saved as a triage note.

View finding in Hacktron

return true
}
}
Expand Down
Loading