High · published November 10, 2025
⚡ An authenticated user can easily slip past OAuth2-Proxy's defenses by crafting sneaky X-Forwarded-* headers that use underscores instead of dashes! 🤯 Think of it like a restaurant accepting reservations with two different formats: if they ignore the difference between underscores and dashes, the wrong party shows up and gets seated at the VIP table! 🍽️ This vulnerability allows a malicious user to escalate privileges in the upstream application, potentially leading to unauthorized access or even full control over sensitive data. If left unpatched, it’s like giving an unwelcome guest the keys to the kingdom! 🚪⚡
Think of it like a restaurant accepting reservations with two different formats: if they ignore the difference between underscores and dashes, the wrong party shows up and gets seated at the VIP table! 🍽️ In OAuth2 Proxy versions prior to 7.13.0, the lack of normalization for HTTP headers meant that attackers could exploit underscore variants to bypass filters, allowing them to control privileged actions in the upstream application. The vulnerability has been addressed in version 7.13.0 by normalizing headers, treating underscores and dashes as equivalent.
This vulnerability allows a malicious user to escalate privileges in the upstream application, potentially leading to unauthorized access or even full control over sensitive data. If left unpatched, it’s like giving an unwelcome guest the keys to the kingdom! 🚪⚡ Upgrade your OAuth2 Proxy to version 7.13.0 or later immediately. Additionally, review your upstream services’ filtering logic to ensure they don’t equate underscores with hyphens. Consider leveraging the new configuration field `InsecureSkipHeaderNormalization` if you need a specific header preserved. You’ve got this! By taking these steps, you’ll help secure your applications and level up your security hero status! 🛡️✨