{"id":"GHSA-w9mr-28mw-j8hg","aliases":["GO-2023-1747"],"status":"published","title":"Hop-by-hop abuse to malform header mutator","description":"### Impact\n\nDownstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:\n\n```yaml\n- id: 'example'\n  upstream:\n    url: 'https://example.com'\n  match:\n    url: 'http://127.0.0.1:4455/'\n    methods:\n      - GET\n  authenticators:\n    - handler: anonymous\n  authorizer:\n    handler: allow\n  mutators:\n    - handler: header\n      config:\n        headers:\n          X-Subject: {{ .Subject }}\n```\n\n```\ncurl -H \"Connection: close,x-subject\" http://127.0.0.1:4455/\n```\n\nThe `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.\n\n### Patches\n\nc5cc7f736dc84185034be4356057d1c7a656d797\n\n### Workarounds\n\nThe downstream server should handle the case that an expected header is not set by responding with an appropriate error.\n\n### References\n\nSee background info in https://github.com/golang/go/issues/50580","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-04-26T19:44:00Z","modified":"2026-03-03T04:53:39Z","fixes":[{"ecosystem":"Go","package":"github.com/ory/oathkeeper","fixed_in":["0.40.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ory/oathkeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ory/oathkeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.40.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ory/oathkeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.40.3"}]}]}],"references":[{"url":"https://github.com/ory/oathkeeper/security/advisories/GHSA-w9mr-28mw-j8hg","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w9mr-28mw-j8hg"},{"url":"https://github.com/ory/oathkeeper","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-w9mr-28mw-j8hg","title":"Hop-by-hop abuse to malform header mutator","description":"### Impact\n\nDownstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:\n\n```yaml\n- id: 'example'\n  upstream:\n    url: 'https://example.com'\n  match:\n    url: 'http://127.0.0.1:4455/'\n    methods:\n      - GET\n  authenticators:\n    - handler: anonymous\n  authorizer:\n    handler: allow\n  mutators:\n    - handler: header\n      config:\n        headers:\n          X-Subject: {{ .Subject }}\n```\n\n```\ncurl -H \"Connection: close,x-subject\" http://127.0.0.1:4455/\n```\n\nThe `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.\n\n### Patches\n\nc5cc7f736dc84185034be4356057d1c7a656d797\n\n### Workarounds\n\nThe downstream server should handle the case that an expected header is not set by responding with an appropriate error.\n\n### References\n\nSee background info in https://github.com/golang/go/issues/50580","status":"published","published":"2023-04-26T19:44:00Z","modified":"2023-04-27T15:52:26Z","updated_at":"2026-11-02T14:36:51.39133Z"}],"osv":[{"id":"GHSA-w9mr-28mw-j8hg","title":"Hop-by-hop abuse to malform header mutator","description":"### Impact\n\nDownstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:\n\n```yaml\n- id: 'example'\n  upstream:\n    url: 'https://example.com'\n  match:\n    url: 'http://127.0.0.1:4455/'\n    methods:\n      - GET\n  authenticators:\n    - handler: anonymous\n  authorizer:\n    handler: allow\n  mutators:\n    - handler: header\n      config:\n        headers:\n          X-Subject: {{ .Subject }}\n```\n\n```\ncurl -H \"Connection: close,x-subject\" http://127.0.0.1:4455/\n```\n\nThe `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.\n\n### Patches\n\nc5cc7f736dc84185034be4356057d1c7a656d797\n\n### Workarounds\n\nThe downstream server should handle the case that an expected header is not set by responding with an appropriate error.\n\n### References\n\nSee background info in https://github.com/golang/go/issues/50580","status":"published","published":"2023-04-26T19:44:00Z","modified":"2024-08-20T20:59:07.014452Z","updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"GO-2023-1747","title":"Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper","description":"Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper","status":"published","published":"2024-08-20T20:29:19Z","modified":"2026-03-03T04:53:39.539492Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}