Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy.<\/p>\n
Root Cause:
\nThe method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so paths containing empty path segments (consecutive slashes), such as \/\/flags, \/flags\/\/ and \/flags\/\/port, are dispatched to the same method as their collapsed form \/flags. Per RFC 3986 these are distinct paths. A front proxy that enforces an ACL (e.g. blocking access to builtin services such as \/flags) matches the collapsed form only, and therefore forwards the padded literal to the bRPC server, where it is dispatched as if it were the collapsed form. This differential allows \/\/flags?setvalue= to reach a builtin service that \/flags is not allowed to reach. Additionally, the HTTP\/2 implementation never validated the :path pseudo-header, so requests without a :path, or with a :path that neither begins with '\/' nor is the asterisk-form '*', contrary to RFC 9113 section 8.3.1, were not rejected.<\/p>\n
Affected Scenarios:
\nDeployments of Apache bRPC behind a front proxy or gateway that performs access control (ACL) decisions on the literal request path, where the bRPC server accepts HTTP or HTTP\/2 traffic from that proxy. In such deployments an attacker can send a path containing empty path segments to reach a resource that the front proxy intended to block.<\/p>\n
How to Fix:
\n(Choose one of the following options)
\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.
\n2. Apply this patch: https:\/\/github.com\/apache\/brpc\/pull\/3512 <\/p>\n
Note:
\nAfter applying the fix, HTTP and HTTP\/2 request paths containing empty path segments (consecutive slashes) are rejected by default, and HTTP\/2 :path values that are empty or neither begin with '\/' nor equal '*' are rejected. Deployments that depend on the previous lenient behavior can restore it by turning on the gflag -http_allow_empty_path_segments, which is not recommended for servers exposed to untrusted traffic.<\/p>\n","protected":false},"excerpt":{"rendered":"
Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy.<\/p>\n
Root C<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-44080","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/44080","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44080"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44080"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44080"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}