Summary
Malcolm's nginx-based reverse proxy has inconsistent URL path normalization between its Lua RBAC authorization layer and nginx request routing. An authenticated user may craft a specially formatted path to bypass role-based restrictions and access administrative or otherwise restricted interfaces.
Malcolm's nginx-based reverse proxy has inconsistent URL path normalization between its Lua RBAC authorization layer and nginx request routing. An authenticated user may craft a specially formatted path to bypass role-based restrictions and access administrative or otherwise restricted interfaces.
Affected context
The issue occurs in Malcolm deployments where the nginx reverse proxy uses Lua-based RBAC checks to protect sensitive routes. Risk is present when the authorization layer interprets a request path differently from nginx's routing logic, potentially affecting restricted file upload, PHP server, htadmin, and authentication management endpoints.
The issue occurs in Malcolm deployments where the nginx reverse proxy uses Lua-based RBAC checks to protect sensitive routes. Risk is present when the authorization layer interprets a request path differently from nginx's routing logic, potentially affecting restricted file upload, PHP server, htadmin, and authentication management endpoints.
Exploit preconditions
- Attack surface: HTTP or HTTPS requests handled by the nginx reverse proxy
- Required access: An authenticated Malcolm account with access to the proxy
- Trigger point: A request directed at an RBAC-protected path using specially formatted path characters or structure
- Why exploitation is possible: The Lua authorization layer and nginx routing logic normalize or resolve the path inconsistently, allowing authorization to be evaluated against a different resource than the one ultimately served
- Attack surface: HTTP or HTTPS requests handled by the nginx reverse proxy
- Required access: An authenticated Malcolm account with access to the proxy
- Trigger point: A request directed at an RBAC-protected path using specially formatted path characters or structure
- Why exploitation is possible: The Lua authorization layer and nginx routing logic normalize or resolve the path inconsistently, allowing authorization to be evaluated against a different resource than the one ultimately served
Why this happens
The underlying bug is an authorization inconsistency caused by applying different URL path normalization rules in separate request-processing components. When the RBAC layer validates one representation of a path while nginx routes another, a request may pass an authorization check intended for a less-sensitive resource and then reach a restricted endpoint. This behavior maps to CWE-863: Incorrect Authorization, because access control enforcement does not reliably correspond to the resource being accessed.
The underlying bug is an authorization inconsistency caused by applying different URL path normalization rules in separate request-processing components. When the RBAC layer validates one representation of a path while nginx routes another, a request may pass an authorization check intended for a less-sensitive resource and then reach a restricted endpoint. This behavior maps to CWE-863: Incorrect Authorization, because access control enforcement does not reliably correspond to the resource being accessed.
Potential impact
- An authenticated user may access administrative or role-gated interfaces
- Unauthorized file uploads may be possible
- Restricted PHP server functionality may be exposed
- htadmin or authentication management settings could be accessed
- Account, authorization, or application configuration may be modified
- The issue could enable further compromise depending on exposed endpoint capabilities
- An authenticated user may access administrative or role-gated interfaces
- Unauthorized file uploads may be possible
- Restricted PHP server functionality may be exposed
- htadmin or authentication management settings could be accessed
- Account, authorization, or application configuration may be modified
- The issue could enable further compromise depending on exposed endpoint capabilities
General mitigation guidance
Mitigation generally focuses on making authorization and routing use the same canonical request representation.
Common defensive patterns include:
- Normalize and canonicalize URL paths once before both authorization and routing decisions
- Apply authorization checks to the final resolved resource rather than an alternate path representation
- Reject ambiguous, malformed, or non-canonical paths by default
- Define explicit allowlists for protected endpoints and methods
- Keep administrative interfaces isolated behind stronger network and identity controls
- Run exposed services with least privilege and limit the permissions of administrative backends
- Add regression tests covering encoded, duplicated, and alternate path-separator forms
Mitigation generally focuses on making authorization and routing use the same canonical request representation.
Common defensive patterns include:
- Normalize and canonicalize URL paths once before both authorization and routing decisions
- Apply authorization checks to the final resolved resource rather than an alternate path representation
- Reject ambiguous, malformed, or non-canonical paths by default
- Define explicit allowlists for protected endpoints and methods
- Keep administrative interfaces isolated behind stronger network and identity controls
- Run exposed services with least privilege and limit the permissions of administrative backends
- Add regression tests covering encoded, duplicated, and alternate path-separator forms
How teams detect issues like this
Organizations can look for authorization and routing inconsistencies through:
- Static analysis and code review of path normalization, decoding, and RBAC middleware
- Tests that compare the path examined by authorization logic with the path ultimately routed by nginx
- Negative tests for encoded delimiters, repeated separators, dot segments, and other ambiguous path forms
- Web access-log analysis for unusual paths followed by successful responses from restricted endpoints
- Policy checks requiring canonicalization before authorization and consistent handling across proxy layers
- Automated security testing or code review tools that identify authorization decisions made on non-canonical input
Organizations can look for authorization and routing inconsistencies through:
- Static analysis and code review of path normalization, decoding, and RBAC middleware
- Tests that compare the path examined by authorization logic with the path ultimately routed by nginx
- Negative tests for encoded delimiters, repeated separators, dot segments, and other ambiguous path forms
- Web access-log analysis for unusual paths followed by successful responses from restricted endpoints
- Policy checks requiring canonicalization before authorization and consistent handling across proxy layers
- Automated security testing or code review tools that identify authorization decisions made on non-canonical input
