Skip to content
Permalink
Browse files Browse the repository at this point in the history
bug: cve exploiting malicious connection header
  • Loading branch information
prometherion committed Feb 20, 2022
1 parent e9fbcf4 commit efe91f6
Show file tree
Hide file tree
Showing 2 changed files with 31 additions and 0 deletions.
1 change: 1 addition & 0 deletions go.mod
Expand Up @@ -11,6 +11,7 @@ require (
github.com/pkg/errors v0.9.1
github.com/spf13/pflag v1.0.5
go.uber.org/zap v1.18.1
golang.org/x/net v0.0.0-20210520170846-37e1c6afe023
k8s.io/api v0.22.0
k8s.io/apimachinery v0.22.1
k8s.io/apiserver v0.22.0
Expand Down
30 changes: 30 additions & 0 deletions internal/webserver/webserver.go
Expand Up @@ -10,6 +10,7 @@ import (
"fmt"
"net/http"
"net/http/httputil"
"net/textproto"
"strings"
"time"

Expand All @@ -18,6 +19,7 @@ import (
"github.com/gorilla/handlers"
"github.com/gorilla/mux"
"github.com/pkg/errors"
"golang.org/x/net/http/httpguts"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apiserver/pkg/authentication/serviceaccount"
Expand Down Expand Up @@ -178,6 +180,9 @@ func (n kubeFilter) impersonateHandler(writer http.ResponseWriter, request *http
if len(n.bearerToken) > 0 {
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", n.bearerToken))
}
// Dropping malicious header connection
// https://github.com/clastix/capsule-proxy/issues/188
n.removingHopByHopHeaders(request)

request.Header.Add("Impersonate-User", username)

Expand Down Expand Up @@ -355,3 +360,28 @@ func (n kubeFilter) getProxyTenantsForOwnerKind(ownerKind capsulev1beta1.OwnerKi

return
}

func (n *kubeFilter) removingHopByHopHeaders(request *http.Request) {
connectionHeaderName, upgradeHeaderName, requestUpgradeType := "connection", "upgrade", ""

if httpguts.HeaderValuesContainsToken(request.Header[connectionHeaderName], upgradeHeaderName) {
requestUpgradeType = request.Header.Get(upgradeHeaderName)
}
// Removing connection headers
for _, f := range request.Header.Values(connectionHeaderName) {
for _, sf := range strings.Split(f, ",") {
if sf = textproto.TrimString(sf); sf != "" {
request.Header.Del(sf)
}
}
}

if requestUpgradeType != "" {
request.Header.Set(connectionHeaderName, upgradeHeaderName)
request.Header.Set(upgradeHeaderName, requestUpgradeType)

return
}

request.Header.Del(connectionHeaderName)
}

0 comments on commit efe91f6

Please sign in to comment.