Synopsis
Access Restriction Bypass Via Origin Spoof
Description
Origin headers are utilised by proxies and/or load balancers to track the originating IP address of the client.
As the request progresses through a proxy, the origin header is added to the existing headers, and the value of the client's IP is then set within this header. Occasionally, poorly implemented access restrictions are based off of the originating IP address alone.
For example, any public IP address may be forced to authenticate, while an internal IP address may not.
Because this header can also be set by the client, it allows cyber-criminals to spoof their IP address and potentially gain access to restricted pages.
Scanner discovered a resource that it did not have permission to access, but been granted access after spoofing the address of localhost (127.0.0.1), thus bypassing any requirement to authenticate.
Solution
Remediation actions may be vastly different depending on the framework being used, and how the application has been coded. However, the origin header should never be used to validate a client's access as it is trivial to change.
Plugin Details
Scan Template: api, basic, full, pci, scan
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: Tenable
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score Source: Tenable
Reference Information
CWE: 290
OWASP: 2010-A3, 2013-A2, 2017-A2, 2021-A7
WASC: Insufficient Authentication
CAPEC: 21, 22, 459, 461, 473, 476, 59, 60, 94
DISA STIG: APSC-DV-001870
HIPAA: 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-4.1.3
PCI-DSS: 3.2-6.5.10