CVE-2021-32637
📋 TL;DR
CVE-2021-32637 is an authentication bypass vulnerability in Authelia that allows attackers to bypass SSO authentication by sending malformed HTTP requests through nginx with ngx_http_auth_request_module. This affects Authelia deployments using nginx as a reverse proxy with the auth_request module. The vulnerability could allow unauthorized access to protected web applications.
💻 Affected Systems
- Authelia
📦 What is this software?
Authelia by Authelia
Authelia by Authelia
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to all protected applications behind Authelia, potentially leading to data breaches, privilege escalation, and lateral movement.
Likely Case
Unauthorized access to protected web applications, potentially exposing sensitive data and functionality to unauthenticated users.
If Mitigated
No impact if proper patching or workarounds are implemented; authentication remains enforced.
🎯 Exploit Status
Exploitation requires crafting malformed HTTP requests but does not require authentication. The vulnerability is straightforward to exploit once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.29.3
Vendor Advisory: https://github.com/authelia/authelia/security/advisories/GHSA-68wm-pfjf-wqp6
Restart Required: Yes
Instructions:
1. Upgrade Authelia to version 4.29.3 or later. 2. Restart Authelia service. 3. Verify the fix by testing authentication with malformed URI paths.
🔧 Temporary Workarounds
Add URI validation in nginx configuration
linuxAdd a block in nginx configuration to reject requests with malformed URI paths in the internal location block
location /internal/ {
if ($request_uri ~ "[^\x20-\x7E]+") {
return 403;
}
}
🧯 If You Can't Patch
- Implement network segmentation to isolate Authelia instances from untrusted networks
- Deploy a WAF (Web Application Firewall) with rules to detect and block malformed URI requests
🔍 How to Verify
Check if Vulnerable:
Check if running Authelia version < 4.29.3 and using nginx with ngx_http_auth_request_module. Test by sending malformed URI requests to protected endpoints.Check Version:
authelia --versionVerify Fix Applied:
After patching, test authentication with malformed URI paths; requests should be properly authenticated or rejected. Verify version is 4.29.3 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication bypass events in Authelia logs
- Requests with malformed URI patterns in nginx access logs
- Successful access to protected resources without proper authentication logs
Network Indicators:
- HTTP requests with non-ASCII or malformed URI paths to Authelia endpoints
- Unusual traffic patterns to protected applications bypassing authentication
SIEM Query:
source="authelia.log" AND (event="authentication bypass" OR status="200" AND user="anonymous") OR source="nginx.log" AND uri MATCHES "[^\\x20-\\x7E]+"🔗 References
- https://github.com/authelia/authelia/commit/c62dbd43d6e69ae81530e7c4f8763857f8ff1dda
- https://github.com/authelia/authelia/security/advisories/GHSA-68wm-pfjf-wqp6
- https://github.com/authelia/authelia/commit/c62dbd43d6e69ae81530e7c4f8763857f8ff1dda
- https://github.com/authelia/authelia/security/advisories/GHSA-68wm-pfjf-wqp6
