Oryam Halachmi

An authentication bypass exists in `X509Authenticator` and `X509AuthenticationListener` where an attacker possessing a certificate from a trusted CA can authenticate as an arbitrary user, including privileged accounts, by influencing the Common Name (CN). The issue stems from an incomplete fix where the regular expression used to extract user identifiers from the Subject DN (Distinguished Name) passed in `$ SERVER['SSL CLIENT S DN']` was not escape-aware. Consequently, the system fails to distinguish between actual RDN (Relative Distinguished Name) separators and separator characters contained within a value. Under RFC 2253, escaped commas are incorrectly read as separators, and bare slashes are treated as separators. In the legacy `X509 NAME oneline()` format, bare commas are treated as separators. This allows a poisoned CN to smuggle a different user address for authentication.

In Docker Desktop for Windows using the WSL2 backend on x86-64 architectures, an unprivileged Linux container can bypass the default seccomp restriction on AF VSOCK by using a 32-bit socketcall. This isolation bypass allows the container to access host-facing services and Windows files accessible to the logged-in user. LinuxKit-based backends are not affected by this issue.