Summary
ABAC-enabled Eclipse BaSyx Go Components up to 1.0.0 suffer from an authorization bypass caused by inconsistent trailing-slash handling between the HTTP router and ABAC middleware.
A network attacker can append a trailing slash to protected API endpoints so that requests bypass ABAC policy checks and filters, potentially enabling unauthorized read, write, delete, or upload actions.
ABAC-enabled Eclipse BaSyx Go Components up to 1.0.0 suffer from an authorization bypass caused by inconsistent trailing-slash handling between the HTTP router and ABAC middleware.
A network attacker can append a trailing slash to protected API endpoints so that requests bypass ABAC policy checks and filters, potentially enabling unauthorized read, write, delete, or upload actions.
Affected context
This vulnerability affects BaSyx Go deployments that:
- Enable Attribute-Based Access Control (ABAC) middleware
- Use the shared HTTP router configuration with
middleware.StripSlashes - Rely on ABAC route lookups to enforce authorization and query filtering
Impacted services include the AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related components that share this routing and middleware stack.
This vulnerability affects BaSyx Go deployments that:
- Enable Attribute-Based Access Control (ABAC) middleware
- Use the shared HTTP router configuration with
middleware.StripSlashes - Rely on ABAC route lookups to enforce authorization and query filtering
Impacted services include the AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related components that share this routing and middleware stack.
Exploit preconditions
- Attack surface: Public or internal HTTP APIs exposed by BaSyx Go Components
- Required access: Ability to send crafted HTTP requests to the affected services; no prior authentication is strictly required if ABAC is the primary control
- Trigger point: Requests to ABAC-protected routes where a trailing slash variant (e.g.,
/shells/vs/shells) exists - Why exploitation is possible: The router strips trailing slashes and dispatches to the protected handler, but the ABAC middleware evaluates the original path and may fail to match slash-suffixed routes, allowing the request to pass without an authorization decision or filters
- Attack surface: Public or internal HTTP APIs exposed by BaSyx Go Components
- Required access: Ability to send crafted HTTP requests to the affected services; no prior authentication is strictly required if ABAC is the primary control
- Trigger point: Requests to ABAC-protected routes where a trailing slash variant (e.g.,
/shells/vs/shells) exists - Why exploitation is possible: The router strips trailing slashes and dispatches to the protected handler, but the ABAC middleware evaluates the original path and may fail to match slash-suffixed routes, allowing the request to pass without an authorization decision or filters
Why this happens
The underlying bug stems from inconsistent normalization of URL paths between the ABAC middleware and the HTTP router.
Chi's middleware.StripSlashes rewrites incoming paths (e.g., /resource/ becomes /resource), while ABAC lookup relies on the unmodified request path, including trailing slashes.
This mismatch maps to CWE-180: Incorrect Calculation / Inconsistent Handling of Paths and CWE-863: Incorrect Authorization, where security logic is applied to a different representation of the resource than the one ultimately served, causing ABAC checks to be skipped on certain route variants.
The underlying bug stems from inconsistent normalization of URL paths between the ABAC middleware and the HTTP router.
Chi's middleware.StripSlashes rewrites incoming paths (e.g., /resource/ becomes /resource), while ABAC lookup relies on the unmodified request path, including trailing slashes.
This mismatch maps to CWE-180: Incorrect Calculation / Inconsistent Handling of Paths and CWE-863: Incorrect Authorization, where security logic is applied to a different representation of the resource than the one ultimately served, causing ABAC checks to be skipped on certain route variants.
Potential impact
- Unauthorized read access to AAS, submodels, registries, and related resources
- Unauthorized creation or modification of assets, submodels, or concept descriptions
- Unauthorized deletion of data or registry entries
- Unauthorized uploads to AAS Environment and related services
- Circumvention of ABAC query filters, leading to overbroad data exposure
- Unauthorized read access to AAS, submodels, registries, and related resources
- Unauthorized creation or modification of assets, submodels, or concept descriptions
- Unauthorized deletion of data or registry entries
- Unauthorized uploads to AAS Environment and related services
- Circumvention of ABAC query filters, leading to overbroad data exposure
General mitigation guidance
Mitigations typically focus on ensuring consistent path normalization across routing and authorization layers and strengthening default-deny behavior.
Recommended patterns include:
- Normalizing request paths once at the edge and ensuring all middleware, including authorization, operate on the same canonical path
- Defining authorization policies against canonicalized routes only, avoiding ambiguous variants with or without trailing slashes
- Applying a default-deny authorization strategy where any route mismatch results in denial rather than pass-through
- Keeping ABAC enforcement tightly coupled with request dispatch so that handlers cannot execute without an authorization decision
- Minimizing reliance on path quirks (such as trailing slashes) for resource identification in security-sensitive logic
Mitigations typically focus on ensuring consistent path normalization across routing and authorization layers and strengthening default-deny behavior.
Recommended patterns include:
- Normalizing request paths once at the edge and ensuring all middleware, including authorization, operate on the same canonical path
- Defining authorization policies against canonicalized routes only, avoiding ambiguous variants with or without trailing slashes
- Applying a default-deny authorization strategy where any route mismatch results in denial rather than pass-through
- Keeping ABAC enforcement tightly coupled with request dispatch so that handlers cannot execute without an authorization decision
- Minimizing reliance on path quirks (such as trailing slashes) for resource identification in security-sensitive logic
How teams detect issues like this
Detection can leverage both code-level and runtime techniques:
- Static analysis or code review to identify authorization middleware that receives different path representations than the router (e.g., checks before or after path rewriting middleware)
- Inspection of routing and middleware chains to confirm that security checks happen after path normalization and for all HTTP methods and route variants
- Logging and monitoring of authorization decisions versus handler executions to flag cases where handlers are invoked without preceding ABAC checks
- Policy enforcement that rejects requests when no explicit ABAC rule matches the canonical route, helping highlight unprotected endpoints
Detection can leverage both code-level and runtime techniques:
- Static analysis or code review to identify authorization middleware that receives different path representations than the router (e.g., checks before or after path rewriting middleware)
- Inspection of routing and middleware chains to confirm that security checks happen after path normalization and for all HTTP methods and route variants
- Logging and monitoring of authorization decisions versus handler executions to flag cases where handlers are invoked without preceding ABAC checks
- Policy enforcement that rejects requests when no explicit ABAC rule matches the canonical route, helping highlight unprotected endpoints
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| gitlab. | gitlab.eclipse.org/ |
| gitlab. | gitlab.eclipse.org/ |
