authelia-server.conf: allow pipe character in URI #213
Conversation
The characters in the regex used for mitigating CVE-2021-32637 are not exhaustive since query strings seem to not always conform to the RFC3986, this is also mentioned in the security advisory for the CVE.[1] For example, attempting to delete multiple torrents in the qBittorrent WebUI results in an URL like the following: confirmdeletion.html?hashes=HASH1|HASH2 This URL is valid and parsable by Authelia, but due to the regex it gets redirected infinitely. To fix this, also allow pipe characters in the request URI. [1] GHSA-68wm-pfjf-wqp6
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thanks for opening this pull request! Be sure to follow the pull request template!
|
I am a bot, here are the test results for this PR: |
|
Thanks, but SWAG (actually our nginx baseimage) is about to go through some major restructuring so we're holding off on merging new PRs in the meantime. I believe as part of the restructuring, we'll remove that regex line as by now everyone should have updated their Authelia to a version with the proper fix. If not they likely won't update SWAG either so no issues there. For now, you can manually edit that line in your instance. |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
should be fixed in #169 |
3 participants
Description:
The characters in the regex used for mitigating CVE-2021-32637 are not exhaustive since query strings seem to not always conform to the RFC3986, this is also mentioned in the security advisory for the CVE.
For example, attempting to delete multiple torrents in the qBittorrent WebUI results in an URL like the following:
This URL is valid and parsable by Authelia, but due to the regex it gets redirected infinitely.
To fix this, also allow pipe characters in the request URI.
Benefits of this PR and context:
The regex was introduced in 224abb6 to work around a CVE. The security advisory notes that the regex is not exhaustive, and there are projects (such as qbittorrent) that use pipe characters in URIs, which are valid and parsable by Authelia.
How Has This Been Tested?
After the regex modification, URLs with pipe characters in them are no longer redirected to the auth endpoint.
Source / References:
Original PR: #130
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-32637