RBAC bypass in nginx Lua layer via percent-encoding, slash-doubling, and case variance

[mmguero]

Malcolm's nginx Lua RBAC check (check_rbac in nginx_auth_helpers.lua) matches role-restricted path patterns (/htadmin, /auth, /admin_login, /arkime/api/esadmin, /netbox, /upload, etc.) against the raw, undecoded ngx.var.request_uri. nginx's own location dispatch, however, percent-decodes and normalizes the URI before matching, and the htadmin/admin_login location uses a case-insensitive regex (~*).

Because the RBAC layer's view of the path and nginx's view of the path can disagree, an authenticated low-privilege user can reach a role-restricted location by:

• percent-encoding a character in the restricted path (e.g. /%68tadmin.php)
• varying case (e.g. /HTADMIN.php)
• slash-doubling, if merge_slashes isn't guaranteed on for the relevant location

nginx routes the request to the restricted backend location in all three cases; check_rbac's pattern match fails to recognize the path as restricted and grants access (path_role_envs is fail-open on non-match — line 437).

Verified end-to-end: authenticated as a low-privilege Keycloak user, /htadmin.php correctly returns 403; /%68tadmin.php with the identical session returns 200 with real htadmin backend content, confirmed via the backend's own access log.

Every entry in path_role_envs is affected, not just htadmin — same bypass applies to all role-restricted prefixes.

Fix: normalize_uri_for_rbac() updated to percent-decode, collapse repeated slashes, collapse traversal sequences, and lowercase — in that order — before matching, so the RBAC layer's normalization agrees with nginx's own decode/case-fold behavior. Verified against malformed escapes, encoded traversal, double-encoding, and overlong-UTF-8 edge cases in a live OpenResty shell; no regressions or new fail-open paths introduced.

See GHSA-jr6p-63pg-hr6g

[mmguero]

nginx RBAC Bypass: Reproduction and Fix Validation

Summary

Reproduced the reported RBAC bypass in nginx_auth_helpers.lua against a live
Malcolm v26.07.0 deployment (Keycloak-backed, ROLE_BASED_ACCESS=true),
confirmed the root cause at the code level via debug logging, and validated
that the patched normalize_uri_for_rbac() closes all three bypass vectors
without regressing legitimate access.

Test user held only ROLE_READ_ACCESS (no admin, no Arkime admin).

Root Cause

check_rbac() matched role-restricted paths against ngx.var.request_uri —
the raw, un-decoded request-line URI — with no percent-decoding, no
case-folding, and only literal-string traversal collapsing. nginx's own
location dispatch, by contrast, percent-decodes and (for the htadmin/admin_login
location) matches case-insensitively. The mismatch meant check_rbac() could
fail to recognize a restricted path was being requested, falling through to
its fail-open branch ("No role restrictions, access granted") even though
nginx would route the request to the real, restricted backend.

Reproduction (Pre-Fix)

Tested three independent bypass vectors, each proven by log evidence that
check_rbac() reached the fail-open grant branch rather than the deny branch,
combined with proof the request reached the real protected backend:

Vector	Payload	Result
Plain percent-encoding	/%68tadmin.php	check_rbac(): No role restrictions, access granted → 302 to real htadmin backend
Encoded-slash traversal	/foo/..%2Fhtadmin.php	Same fail-open branch → 302, real PHPSESSID cookie issued by htadmin's own PHP session, confirming the backend actually served the request
Case variance	/HTADMIN.php, /Htadmin.php	Same fail-open branch → request reached the real backend's own nginx, which returned its own 404 (distinct server header/branding from the front-proxy's 403 page), confirming pass-through

Debug logging (ngx.log(ngx.WARN, "raw request_uri: ", ngx.var.request_uri, ...))
confirmed ngx.var.request_uri was still literally /%68tadmin.php at the
point check_rbac() read it, proving the mismatch is real and not an
artifact of some other layer.

Note: In my original testing environment, Traefik was sitting in front of nginx.
Go's URL re-escaping (used internally by Traefik when proxying) silently decodes
plain-letter percent-encodings like %68 before forwarding to nginx, but
deliberately preserves %2F since it's structurally significant. This meant
the plain-encoding bypass was accidentally neutralized when tested through
Traefik, while the encoded-slash and case-variance bypasses were not. The
plain-encoding bypass was confirmed independently by connecting directly to
the nginx container, bypassing Traefik, with the Keycloak session cookie
still valid (auth flow is unaffected since only the payload request skips
Traefik, not the login).

Both /htadmin.php and /auth (unencoded, literal) were correctly blocked
throughout, confirming baseline RBAC enforcement works as designed for the
literal-path case — this is a bypass of the matching logic, not a wholesale
failure of RBAC.

Fix

normalize_uri_for_rbac() updated to, in order:

1. Percent-decode (ngx.unescape_uri) — before traversal collapsing, so
   encoded traversal sequences can't skip the collapse step.
2. Collapse repeated slashes.
3. Collapse /../ traversal sequences (existing logic, unchanged).
4. Lowercase the result — matches both call sites (check_rbac,
   set_headers's role-expansion), which only ever use this output for
   pattern matching.

Verified in isolation (via resty CLI) against malformed/truncated escapes,
double-encoding, and overlong-UTF-8 sequences — no crashes, no double-decode
mismatch, no unexpected fail-open paths introduced by the new decode step.

Fix Validation (Post-Fix)

Same three payloads, same direct-to-nginx harness, confirmed via log:

Vector	Payload	Result
Plain percent-encoding	/%68tadmin.php	check_rbac(): does not have required role → 403
Encoded-slash traversal	/foo/..%2Fhtadmin.php	Same deny branch → 403
Case variance	/HTADMIN.php	Same deny branch → 403

All three now hit the same deny branch that correctly blocks the literal
/htadmin.php case, rather than the fail-open grant branch, confirming
normalize_uri_for_rbac() decodes, lowercases, and collapses these paths
into /htadmin.php before the role-pattern match runs.

Legitimate access re-verified as a regression check: /netbox (unencoded)
and other URIs still correctly granted via the general-access role rule.

Conclusion

All three reported bypass vectors reproduced and root-caused against the
actual deployed code, and confirmed closed by the patched
normalize_uri_for_rbac() with no observed regression to legitimate access.