Summary
A broken authentication vulnerability in brpc can allow requests to authenticated services without valid credentials when authentication and an internal port are configured together. A remote attacker may first access a built-in service on that port and then reuse the authenticated connection to reach ordinary services.
A broken authentication vulnerability in brpc can allow requests to authenticated services without valid credentials when authentication and an internal port are configured together. A remote attacker may first access a built-in service on that port and then reuse the authenticated connection to reach ordinary services.
Affected context
The issue arises in brpc::Server deployments that configure both ServerOptions.auth and ServerOptions.internal_port. The internal port exempts built-in services from credential checks, while authentication state is retained for the lifetime of a connection. Risk depends on network reachability to the internal port and on ordinary authenticated services being available through the same request path.
The issue arises in brpc::Server deployments that configure both ServerOptions.auth and ServerOptions.internal_port. The internal port exempts built-in services from credential checks, while authentication state is retained for the lifetime of a connection. Risk depends on network reachability to the internal port and on ordinary authenticated services being available through the same request path.
Exploit preconditions
- Attack surface: Network-accessible HTTP service on
internal_port - Required access: Remote network access to the internal port; valid credentials are not required
- Trigger point: A built-in service request followed by a request for an ordinary authenticated service on the same connection
- Why exploitation is possible: Authentication is evaluated only for the first message, and the successful built-in-service exemption is latched for subsequent requests
- Attack surface: Network-accessible HTTP service on
internal_port - Required access: Remote network access to the internal port; valid credentials are not required
- Trigger point: A built-in service request followed by a request for an ordinary authenticated service on the same connection
- Why exploitation is possible: Authentication is evaluated only for the first message, and the successful built-in-service exemption is latched for subsequent requests
Why this happens
The vulnerability results from treating a connection-level authentication decision as sufficient for every request on that connection. When a built-in service is requested on internal_port, VerifyHttpRequest() returns success without checking credentials. Because that result is not recalculated for each request, later requests for ordinary services inherit the exemption. This maps to CWE-287, Improper Authentication, because access control does not reliably verify the identity or authorization of the requester before dispatching protected services.
The vulnerability results from treating a connection-level authentication decision as sufficient for every request on that connection. When a built-in service is requested on internal_port, VerifyHttpRequest() returns success without checking credentials. Because that result is not recalculated for each request, later requests for ordinary services inherit the exemption. This maps to CWE-287, Improper Authentication, because access control does not reliably verify the identity or authorization of the requester before dispatching protected services.
Potential impact
- An attacker may access ordinary services without valid credentials.
- Sensitive application data could be disclosed.
- Protected administrative or operational actions could be performed.
- Service behavior or stored data could be modified without authorization.
- The affected server could become a stepping stone for further compromise.
- An attacker may access ordinary services without valid credentials.
- Sensitive application data could be disclosed.
- Protected administrative or operational actions could be performed.
- Service behavior or stored data could be modified without authorization.
- The affected server could become a stepping stone for further compromise.
General mitigation guidance
Mitigation generally focuses on separating internal service exposure from ordinary authenticated service handling. Internal ports should be restricted to explicitly permitted built-in and Tabbed services, while ordinary services should be served through a path that performs authentication for every request. Authentication decisions should be request-scoped rather than inherited from an earlier message on a persistent connection. Network policies can reduce reachability to internal ports, and least-privilege service identities can limit consequences if an access-control boundary is bypassed. Secure-by-default routing should reject unsupported service types on internal interfaces.
Mitigation generally focuses on separating internal service exposure from ordinary authenticated service handling. Internal ports should be restricted to explicitly permitted built-in and Tabbed services, while ordinary services should be served through a path that performs authentication for every request. Authentication decisions should be request-scoped rather than inherited from an earlier message on a persistent connection. Network policies can reduce reachability to internal ports, and least-privilege service identities can limit consequences if an access-control boundary is bypassed. Secure-by-default routing should reject unsupported service types on internal interfaces.
How teams detect issues like this
Review server configurations for simultaneous use of authentication and internal ports, especially where ordinary services are routable through the internal interface. Static analysis and code review should look for connection-scoped authentication state, success paths that bypass credential checks for built-in services, and missing per-request authorization checks. Integration tests should send an exempt built-in-service request followed by an unauthorized ordinary-service request on the same persistent connection. Network policy and HTTP access logs can help identify ordinary service traffic reaching internal ports. Automated security review tools may assist with identifying these authentication and routing patterns.
Review server configurations for simultaneous use of authentication and internal ports, especially where ordinary services are routable through the internal interface. Static analysis and code review should look for connection-scoped authentication state, success paths that bypass credential checks for built-in services, and missing per-request authorization checks. Integration tests should send an exempt built-in-service request followed by an unauthorized ordinary-service request on the same persistent connection. Network policy and HTTP access logs can help identify ordinary service traffic reaching internal ports. Automated security review tools may assist with identifying these authentication and routing patterns.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| lists. | lists.apache.org/ |
