Bug 2321258 (CVE-2024-10295)

Summary: CVE-2024-10295 Gateway: APICast Basic Auth Bypass via Malformed Base64 HeadersSending non-base64 'basic' auth with special characters causes APICast to incorrectly authenticate a request
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, akostadi, alcohan, amasferr, amctagga, anjoseph, ansmith, anstephe, aoconnor, aprice, asoldano, avibelli, bbaranow, bdettelb, bgeorges, bmaxwell, bniver, boliveir, brian.stansberry, brking, caswilli, cbartlet, ccranfor, cdaley, cdewolf, chazlett, chfoley, clement.escoffier, cmah, cmiranda, dandread, danken, darran.lofthouse, davidn, dhanak, dkreling, dmayorov, doconnor, dosoudil, drichtar, dsimansk, dymurray, eaguilar, ebaron, eglynn, ehelms, fdeutsch, fjuma, flucifre, fmariani, fmongiar, ggainey, gkamathe, gmalinko, gmeno, gparvin, gsmet, gtanzill, haoli, hkataria, ibolton, istudens, ivassile, iweiss, janstey, jcammara, jcantril, jchui, jjoyce, jkoehler, jkoops, jlledo, jmartisk, jmatthew, jmitchel, jmontleo, jneedle, jnethert, jolong, jpechane, jpoth, jprabhak, jsamir, jschluet, jscholz, juwatts, jwendell, kaycoth, kegrant, kholdawa, kingland, koliveir, kshier, ktsao, kverlaen, lchilton, lgao, lhh, lsvaty, lthon, mabashia, manderse, matzew, mbenjamin, mburns, mgarciac, mhackett, mhulan, mjaros, mkudlej, mmakovy, mnovotny, mosmerov, mpierce, mrajanna, mrunge, msochure, msvehla, muagarwa, mwringe, nboldt, njean, nmoumoul, nwallace, olubyans, oramraz, owatkins, pahickey, parichar, pbraun, pcongius, pcreech, pdelbell, pdrozd, peholase, pgaikwad, pgallagh, pgrist, phoracek, pierdipi, pjindal, pmackay, probinso, pskopek, rcernich, rchan, rguimara, rhaigner, rhos-maint, rhuss, rjohnson, rmartinc, rowaters, rruss, rstancel, rstepani, rsvoboda, rtaniwa, sakbas, saroy, sausingh, sbiarozk, sdawley, sdouglas, sfeifer, sfroberg, shvarugh, simaishi, slucidi, smaestri, smallamp, smcdonal, smullick, sostapov, sseago, stcannon, sthirugn, sthorger, stirabos, swoodman, tasato, tcunning, teagle, tfister, thason, thavo, tjochec, tkral, tom.jenkinson, tqvarnst, twalsh, vereddy, vimartin, vkrizan, whayutin, wtam, yfang, yguenane, ypadia
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-10-23 10:27:26 UTC 
When a request contains an invalid base64-encoded header (e.g., Authorization: Basic 1234?), APICast does not properly handle the decoding failure. Instead, it skips the remaining authentication steps and processes the request, allowing unauthorized access to the backend service. This can lead to potential security risks as unverified requests are processed by the backend.