Rootxharsh

A configuration-dependent authentication bypass exists when the software is deployed using `skip auth routes` or the legacy `skip auth regex` with patterns that can be widened by attacker-controlled suffixes. This occurs when protected upstream applications interpret the `#` character as a fragment delimiter or route the request to the protected base path. An unauthenticated attacker can send a crafted request containing a number sign in the path, including the browser-safe encoded form `%23`, allowing the request to match a public allowlist rule while the backend serves a protected resource.

A security issue exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed using URL-encoded characters. For example, using `/%61dmin` instead of `/admin`. The middleware engine fails to match the encoded path, skipping execution, but the Fastify router decodes the path and matches the route handler, potentially allowing access to protected endpoints. The issue occurs because the underlying Fastify router correctly decodes the path while the middleware engine does not. This allows attackers to bypass middleware constraints and access protected endpoints.

A security issue exists in the @fastify/express plugin, which provides Express compatibility for Fastify. The problem occurs when middleware is registered with a specific path prefix. Attackers can bypass the middleware by using URL-encoded characters in the request path, such as `/%61dmin` instead of `/admin`. The Fastify router correctly decodes the path and matches the route handler, allowing access to protected endpoints without the intended middleware restrictions. This bypass is due to how @fastify/express matches requests against registered middleware paths.

Hardcoded DNS key usage has been found in Netmaker, allowing unauthorized users to interact with DNS API endpoints. The issue is patched in version 0.17.1 and fixed in version 0.18.6.

An Insecure Direct Object Reference (IDOR) vulnerability was found in the user update function, allowing an attacker to update another user's password by specifying their username.

A Mass assignment vulnerability was found in Netmaker that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in version 0.17.1 and fixed in version 0.18.6.

A security flaw has been discovered in Lucee, impacting all prior releases. New releases (5.4.3.2, 5.3.12.1) have been made to address the issue and enhance security.

The issue is related to an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. However, by crafting a redirect URL with HTML encoded whitespace characters, the validation could be bypassed and allow a redirect to any URL provided.