PT-2023-25576 · Authentik · Authentik
Thijsa
·
Publicado
2023-07-06
·
Atualizado
2026-04-16
·
CVE-2023-36456
CVSS v3.1
8.3
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
authentik versions prior to 2023.4.3 and 2023.5.5
Description
The issue concerns the lack of verification of the source of the
X-Forwarded-For and X-Real-IP headers in authentik, an open-source Identity Provider. This poses a security risk when flows or policies check the user's IP address, such as ignoring 2-factor authentication when connected to a company network. Additionally, IP addresses in logfiles and user sessions become unreliable, and anybody can spoof this address. The header is also passed on to proxied applications behind an outpost, allowing for potential verification, logging, blocking, or rate limiting based on the IP address to be overridden.Recommendations
For versions prior to 2023.4.3, update to version 2023.4.3 or later to resolve the issue.
For versions prior to 2023.5.5, update to version 2023.5.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
X-Forwarded-For and X-Real-IP headers until a patch is applied.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Authentik