fix(authx): avoid override secrets#5462
fix(authx): avoid override secrets#5462dwisiswant0 merged 6 commits intoprojectdiscovery:feat/authx/add-overwrite-fieldfrom dwisiswant0:dwisiswant0/fix/avoid-overriding-secrets
Conversation
Signed-off-by: Dwi Siswanto <git@dw1.io>
Signed-off-by: Dwi Siswanto <git@dw1.io>
Signed-off-by: Dwi Siswanto <git@dw1.io>
Signed-off-by: Dwi Siswanto <git@dw1.io>
Signed-off-by: Dwi Siswanto <git@dw1.io>
There was a problem hiding this comment.
i am not sure if this is right approach ,
from what i can understand user wants to avoid sending auth data when it is not required i.e HEAD , OPTIONS http methods .
apart from that i don't see a usecase where we don't want to override
we support many input sources ( proxify , burpsuite saved items being one of them ) . in proxy logs it is most likely that it will have credentials ( expired ones in most cases) and we would want to replace them in most /general scenarios, even for basicAuth replacing them does no harm
we can avoid sending them on OPTIONS , HEAD http request methods and for custom or non-general scenarios based on use case of user we can add more filters ( ex: maybe method or path based regex filter )
for conditions where exploit uses these headers we can add new variable in template field to skip-auth: true or something similar (if required)
cc: @ehsandeep
Template:
```yaml
- |
GET / HTTP/1.1
Host: {{Hostname}}
X-Secret-Type: header
foo: default
```
If the secret file content is like this:
```yaml
- type: header
domains:
- header.oast.fun
overwrite: true
headers:
- key: foo
value: OVERRIDEN
```
The request being sent is:
```
GET / HTTP/1.1
Host: header.oast.fun
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686; rv:122.0) Gecko/20100101 Firefox/122.0
Connection: close
X-Secret-Type: header
foo: default
Foo: OVERRIDEN
Accept-Encoding: gzip
```
Signed-off-by: Dwi Siswanto <git@dw1.io>
|
@tarunKoyalwar - the issue author concern is "[...] Authorization header either gets inserted or overridden".
But, I think the special conditions you mentioned are unnecessary since they don't really impact the server.
Although I'm down with this. I'm turning this into a draft and working on a workaround by adding an |
|
UPDATE: Changing the base branch and removing the closing issue keywords. |
|
Hi all, |
Proposed changes
Avoid overriding secrets.
Proof
Template:
Secret File content:
Command:
Note
If you spot an OVERRIDEN value in the dumped HTTP request, it means that a hardcoded secret value has been overridden or replaced from the Secret File.
Checklist