Seth Grover

An inconsistency in URL path normalization exists between the Lua-based role-based access control (RBAC) authorization layer and the nginx request routing logic in the reverse proxy. An authenticated user can bypass role-based restrictions by crafting a specially formatted request path to access administrative or role-gated endpoints. This issue impacts all restricted paths protected by the RBAC layer, such as the file upload, PHP server, htadmin, and authentication management interfaces.

The nginx Lua role-based access control (RBAC) layer fails to percent-decode the request URI before performing pattern-matching to restrict access to sensitive paths. While the RBAC gate evaluates the raw, percent-encoded string, nginx uses the percent-decoded, normalized URI to route the request to the appropriate location block. This discrepancy allows an authenticated user with low privileges to bypass access restrictions by using percent-encoding in the request URI, such as requesting `/%68tadmin.php` instead of `/htadmin.php`, to reach restricted endpoints including `/htadmin`, `/auth`, `/admin login`, `/arkime/api/esadmin`, NetBox, and upload endpoints.

The upload-processing pipeline in `scripts/safe-extract.py` fails to apply entry-count, nesting-depth, and total-uncompressed-byte limits when processing single-stream compressed formats such as .gz, .bz2, .xz, .lzma, and .lz that are not .tar.*-style archives. This allows an authenticated user with upload permissions for PCAP or log files to upload a highly compressible file, such as a gzip bomb (a malicious archive designed to crash a system by expanding to an enormous size), which can exhaust the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, leading to platform disruption for all users.

The front nginx reverse proxy uses a case-insensitive regex matcher for the Dashboards to Arkime shortcut location, but employs a case-sensitive rewrite. If a request path is not in exact lowercase, it bypasses the rewrite and is passed directly to the Arkime backend via `proxy pass`. Because this specific location lacks the required authentication file, requests reach the backend unauthenticated. Additionally, the proxy forwards the client-supplied `X-Forwarded-User` header without overwriting it. Since Arkime trusts this header for identity, an unauthenticated attacker can access the backend by forging an auto-provisioned identity.

The Flask application exposes the 'POST /script call/<script>' endpoint without authentication and utilizes wildcard Cross-Origin Resource Sharing (CORS), which allows requests from any origin. This configuration enables an attacker to use Cross-Site Request Forgery (CSRF) to force an operator's browser to execute arbitrary management commands. Examples of such commands include `control.py --wipe`, which permanently deletes forensic logs and captured network traffic, and `control.py --stop`, which disables security monitoring.

The Arkime live capture service (`arkime-live`) within Malcolm is configured with `network mode: host`, which exposes port 8005 across all network interfaces via `viewHost=0.0.0.0`. The service is configured to trust the `X-Forwarded-User` header from any IP address (`userAuthIps=::,0.0.0.0/0`) and automatically creates users with full access. Additionally, the `passwordSecret` is hardcoded to the public value "Malcolm". A network-adjacent attacker can bypass the nginx proxy by connecting directly to port 8005 using a forged identity header.

The file-upload component incorporates the FilePond PHP server, which includes an `index.php` file exposing a fetch API route. This route allows the server to download an arbitrary URL using curl with the FOLLOWLOCATION option enabled. When a HEAD request is made, the server stores the fetched response body in the upload container's transfer directory and returns a transfer ID, allowing the caller to read back the fetched content.