Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers

T1Covered by 1 source · first reported by Tenable Research at 19 Jun, 06:41 UTC

Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers When 'ENABLE_REVERSE_PROXY_AUTHENTICATION' is enabled, Gogs accepts the configured authentication header (default: 'X-WEBAUTH-USER') directly from client requests without validating that the request originated from a trusted reverse…

security

Sources

• T1Gogs - Authentication Bypass via Unvalidated Reverse Proxy HeadersTenable Research19 Jun, 06:41