WS-2023-0113

Date: April 26, 2023

A hop-by-hop abuse was found in oathkeeper. Downstream services relying on the presence of headers set by the header mutator could be exploited. A client can drop the header set by the header mutator by including that header's name in the Connection header. The X-Subject header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name. The issue is patched in version 0.40.3.

Language: Go