Authorization bypass / Access control

PoC steps to reproduce (conceptual, requires a test/development setup): Prerequisites: - VictoriaMetrics vmauth configured with an unauthorized_user backend, e.g.: - unauthorized_user: url_prefix: http://BACKEND/bar - A backend service listening on BACKEND/bar that responds 200 OK to requests for /abc - A public key used to validate JWTs, and a token configured to be signed with the corresponding private key - A JWT token that does NOT contain the vm_access claim (and does not rely on a default vm_access claim in the config) 1) Start vmauth with a configuration that includes an unauthorized_user path (as in the test changes) so that requests can be forwarded to the BACKEND/bar backend when there is no vm_access claim in the JWT. 2) Generate a JWT that is valid (signature checks out) but intentionally omits the vm_access claim. Example payload (conceptual): {"iss":"test","sub":"tester"} (sign with the private key corresponding to the public key configured in vmauth) Save as token.jwt 3) Send an authenticated request to vmauth, using the token without vm_access claim: curl -sS \ -H "Authorization: Bearer <token_without_vm_access>" \ http://127.0.0.1:8428/vmauth/some/resource 4) Expected outcome with the patched behavior: - Since the token lacks vm_access and there is no DefaultVMAccessClaim configured, vmauth will fall through to the unauthorized_user path, forwarding to the BACKEND/bar backend. If that backend is configured to allow the operation, you should see a 200 OK response from the backend (mirrored by vmauth). 5) For contrast, in a pre-patch environment (or by temporarily simulating the old flow), the same request would typically yield HTTP 401 Unauthorized from vmauth before hitting the unauthorized_user backend. Notes: - The actual token generation requires the proper RSA/ECDSA key material used by vmauth for JWT validation. The payload here is illustrative; you must sign with the corresponding private key and validate against the configured public_keys in vmauth. - This PoC demonstrates the authorization path behavior difference caused by the patch, not a universal vulnerability that applies to all deployments. The impact depends on how the unauthorized_user backend is configured and what access it exposes.

diff --git a/app/vmauth/main.go b/app/vmauth/main.go index a020110b92b57..4c09231b98bd8 100644 --- a/app/vmauth/main.go +++ b/app/vmauth/main.go @@ -193,14 +193,13 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool { if tkn == nil { logger.Panicf("BUG: unexpected nil jwt token for user %q", ui.name()) } - if !tkn.HasVMAccessClaim() && ui.JWT.DefaultVMAccessClaim == nil { - ui.logRequest(r, `unauthorized`, http.StatusUnauthorized, 0) - http.Error(w, "Unauthorized", http.StatusUnauthorized) + defer putToken(tkn) + // Call processUserRequest only if the token contains the vm_access claim + // or a default claim is configured; otherwise fall through to unauthorized_user. + if tkn.HasVMAccessClaim() || ui.JWT.DefaultVMAccessClaim != nil { + processUserRequest(w, r, ui, tkn) return true } - defer putToken(tkn) - processUserRequest(w, r, ui, tkn) - return true } uu := authConfig.Load().UnauthorizedUser diff --git a/app/vmauth/main_test.go b/app/vmauth/main_test.go index 4f9ff213161b8..2d1310eba9e48 100644 --- a/app/vmauth/main_test.go +++ b/app/vmauth/main_test.go @@ -785,7 +785,26 @@ statusCode=401 Unauthorized` f(simpleCfgStr, request, responseExpected) - // token without vm_access claim is accepted when it + // token without vm_access claim should fall through to unauthorized_user + request = httptest.NewRequest(`GET`, "http://some-host.com/abc", nil) + request.Header.Set(`Authorization`, `Bearer `+noVMAccessClaimToken) + responseExpected = ` +statusCode=200 +path: /bar/abc +query: +headers:` + f(fmt.Sprintf(` +unauthorized_user: + url_prefix: {BACKEND}/bar +users: +- jwt: + public_keys: + - %q + match_claims: + role: admin + url_prefix: {BACKEND}/foo`, string(publicKeyPEM)), request, responseExpected) + + // token without vm_access claim is accepted when default_vm_access_claim configured request = httptest.NewRequest(`GET`, "http://some-host.com/abc", nil) request.Header.Set(`Authorization`, `Bearer `+roleToken) responseExpected = `