Quick tip: Watch out — restriction by location can be circumvented.

by @Andrey Danau, Wallarm Research

If you are like many app developers, you may be using nginx or apache proxy or a web server on the front end of your application. If you are on a tight schedule, it is tempting to tie authorization and data controls simply to the locations defined in the front end.

Here lies a pitfall — due to a different treatment of the location path by the java-based back-end and the front-end. Because of this, it is possible to bypass the location-based restrictions.

Let’s consider an example where a basic authorization can be circumvented.

The example in this post was tested with Apache/2.4.27 (Ubuntu), nginx/1.10.3(Ubuntu)

Apache configuration was as follows:

<VirtualHost *:80>

ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Location /resin-doc/>
AuthType Basic
AuthName ‘test’
AuthUserFile ‘/etc/.htpasswd’
Require valid-user
</Location>

ProxyPass / http://0.0.0.0:8080/
ProxyPassReverse / http://0.0.0.0:8080/
</VirtualHost>

For nginx:

location / {
             proxy_pass http://localhost:8080;
           }
location /resin-doc/ {
                      auth_basic “closed site”;
                      auth_basic_user_file /etc/.htpasswd;
                     }

Apache or nginx were used as front-end with a proxy to backend on port *:8080; backend is implemented with a web server running on Resin/4.0.55

Using Apache or nginx as a proxy server to Resin we can circumvent location restrictions, for example when they are used for the authorization.

URL http://localhost/resin-doc/ will request the credentials (login name and password) with a special request that will look similar to this: http://localhost/%C0%AFresin-doc%C0%AFindex.xtp

(%C0%AF is a unicode encoded symbol “/”)

Alternatively, the request can take a form of http://localhost/resin-docindex.xtp

Resin normalizes “” into “/”.

Unlike Resin, neither Apache nor nginx change the path at all and do not normalize which means that by the time location is presented to the back-end it looks like http://localhost/resin-doc/index.xtp , and the location restrictions are bypassed.

Although this case can be considered a simple configuration error, the consequences can be quite serious. Watch out for it.