Erlang OTP mod_auth authentication path confusion vulnerability

Vulnerability Overview Vulnerability Type: HTTP Authentication Path Confusion Root Cause: The module does not inject the and parameters into when generating the authentication path. This causes a user added to one protected to be erroneously able to authenticate against other protected directories. Affected Scope: Affected module: Affected test file: Affected version: OTP-26.5.0.6 (based on the branch tag in the screenshot) Fix Details Core Fix: Modify the module to ensure that and are injected into before invoking the backend authentication logic, thereby isolating the authentication contexts of different directories. Test Enhancement: Add an test case to to verify that cross-directory authentication isolation is effective. POC / Test Code The screenshot includes test code (located in ) used to verify the fix for this vulnerability: ```erlang auth_directory_isolation(Config) when is_list(Config) -> [{doc, "Verify that per-directory auth namespaces are isolated (OK-1082). " "A user added to /dirA must NOT be able to authenticate against /dirB."}, {version, "Verify that per-directory auth namespaces are isolated (OK-1082). " "A user added to /dirA must NOT be able to authenticate against /dirB."}, {auth_api_meta, [{auth_api_1, auth_api_1.0}, {auth_api_meta, [{auth_api_1, auth_api_1.0}]}, {auth_api_mnesia, [{auth_api_1, auth_api_1.0}]}, {auth_api_mnesia, [{auth_api_1, auth_api_1.0}]}, {security, [{security_1, security_1.0}]}, {logging, [{disk_log_internal, disk_log_stats, disk_log_max_size, disk_log_bad_file}]}, {skip, "Host does not support IPv6"} ]; %% Setup {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get_value(http_version, Config), {ok, _} = proplists:get

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP mod_auth authentication path confusion vulnerability

More from this source