Downstream services relying on the presence of headers set by the header
mutator could be exploited. A client can drop the header set by the header
mutator by including that header's name in the Connection
header. Example minimal config:
- id: 'example'
upstream:
url: 'https://example.com'
match:
url: 'http://127.0.0.1:4455/'
methods:
- GET
authenticators:
- handler: anonymous
authorizer:
handler: allow
mutators:
- handler: header
config:
headers:
X-Subject: {{ .Subject }}
curl -H "Connection: close,x-subject" http://127.0.0.1:4455/
The X-Subject
header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.
c5cc7f736dc84185034be4356057d1c7a656d797
The downstream server should handle the case that an expected header is not set by responding with an appropriate error.
See background info in https://github.com/golang/go/issues/50580
{ "nvd_published_at": null, "cwe_ids": [], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2023-04-26T19:44:00Z" }