Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a critical security flaw found in a component that helps expose gRPC services to the internet. The vulnerability allows attackers to bypass security checks by manipulating request headers, potentially leading to unauthorized access and data compromise. The main concern is confirming whether this specific technology is in use and, if so, assessing its exposure.
- Bypasses security controls for web requests.
- Critical flaw impacts widely deployed internet-facing services.
- Confirm usage and exposure of this technology.
Attack Path
How an attacker could exploit the issue
An attacker can reach this vulnerability by sending a specially crafted POST request to an application using the vulnerable component. This request would include a `X-HTTP-Method-Override` header set to an arbitrary HTTP method. The application, without proper checks, would then process this header, rewriting the request method before routing it. This bypasses any access controls that rely on HTTP methods, potentially allowing unintended actions.
- Entry condition: Network exposure, no authentication.
- Trigger point: Malicious POST request with override header.
- Resulting risk: Bypasses controls, leading to high impact.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to bypass access controls and execute arbitrary operations on a server running an affected application. When requests are processed with a specific content type and an overridden HTTP method, the server may perform actions not intended by the legitimate user, potentially affecting service integrity and confidentiality.
- Server logic and data could be exposed.
- Bypass access controls via header manipulation.
- Unauthorized actions may compromise services.
Operational Fix
Recommended remediation, mitigation, and detection steps
The `grpc-gateway` component, often used to expose gRPC services via HTTP/REST, is the likely point of vulnerability. Application owners or platform teams responsible for API gateways and service exposure should initiate an inventory of deployments. Confirming reachability and business criticality will guide prioritization for remediation, which may involve coordination with vendors or implementing temporary controls.
- Identify, confirm, and assign ownership.
- Verify exposure and criticality of deployments.
- Plan vendor coordination or remediation.
