Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Eclipse BaSyx Go Components that could allow unauthorized access to services. The issue arises from how trailing slashes are handled differently by the application's routing and authorization components, potentially enabling attackers to bypass security checks and perform unintended operations on sensitive data. The main concern is confirming relevance and exposure to ABAC-enabled deployments.
- A technical flaw allows bypassing access controls.
- Affects systems that manage industrial and web data.
- Confirm if your services using this component are affected.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authorization checks by appending a trailing slash to certain API requests, allowing them to access protected resources. This occurs because the system inconsistently handles trailing slashes between its router and its authorization middleware. When a request with a trailing slash is made, the router may strip it before the authorization logic is applied, leading to unauthorized access.
- Unauthenticated network access is required.
- Append a trailing slash to protected API routes.
- Unauthorized access to data and operations.
Live Threat
Current exploitation, exposure, and threat context
In ABAC-enabled deployments of Eclipse BaSyx Go Components, an attacker could bypass authorization checks by appending a trailing slash to API routes. This could lead to unauthorized access and manipulation of data or service functions, depending on the specific component and its deployed policy.
- System data and APIs at risk.
- Unauthorized access via altered URLs.
- Unauthorized read, create, update, delete operations.
Operational Fix
Recommended remediation, mitigation, and detection steps
In ABAC-enabled Eclipse BaSyx Go Components deployments, this vulnerability resides within the application's routing and authorization logic. The initial triage involves identifying all instances of the affected services, determining their network exposure and criticality, and locating the accountable application or platform owner. Remediation planning should then prioritize these high-risk assets, potentially involving coordination with vendor management if customization or specific configurations are in place.
- Application owners should manage the issue.
- Verify network exposure and asset criticality.
- Plan remediation based on asset risk.
