Malcolm’s front nginx reverse proxy defines a “Dashboards \u2192 Arkime shortcut” location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example \/IDDASH2ARK\/…) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location’s proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username \u2014 so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.<\/p>\n","protected":false},"excerpt":{"rendered":"
Malcolm’s front nginx reverse proxy defines a “Dashboards \u2192 Arkime shortcut” location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-low<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34690","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}