CVE-2024-47070

Executive Summary

CVE-2024-47070 is a critical authentication bypass vulnerability in authentik, an open-source identity provider. The flaw allows an attacker to bypass password login by sending a crafted X-Forwarded-For header containing an unparsable IP address (e.g., a). This causes an exception in the password stage, which, due to a misconfigured policy binding (where failure_result is not set to True), results in the policy returning false and the password stage being skipped entirely. An attacker can then log into any account with a known login or email address. The vulnerability is exploitable only if the authentik instance trusts the X-Forwarded-For header from the attacker, which is typical in reverse proxy setups. The CVSS score is 9.1 (Critical), and the EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the impact is severe.

Supply Chain & Package Security

This vulnerability affects the authentik open-source project, which is distributed as a Docker image and Python package. Users should verify the integrity of their authentik installation and ensure they are using a patched version. The fix is included in versions 2024.8.3 and 2024.6.5. No malicious packages have been reported in the supply chain, but users should always verify checksums and signatures.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full account takeover leads to data exposure.
• Integrity Impact: High (I:H) – Attacker can modify account settings and data.
• Availability Impact: High (A:H) – Attacker can lock out legitimate users.

Threat Level: Critical. The vulnerability allows complete account takeover with a simple HTTP header manipulation. Although the EPSS score is low, the ease of exploitation and high impact make it a priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the password stage of authentik's authentication flow. The flow typically involves an identification stage (where the user provides a username/email) followed by a password stage. In certain configurations, a policy is bound to the password stage to skip it if the identification stage already includes a password field (e.g., in a combined login form). The policy checks the X-Forwarded-For header to determine the client's IP address for rate-limiting or other purposes.

When an attacker sends a request with an X-Forwarded-For header containing an invalid IP address (e.g., a), the code attempts to parse it as an IP address. This parsing fails and raises an exception. Due to a misconfiguration in the default blueprint, the policy binding's failure_result is not set to True. This means that when the exception occurs, the policy returns false (instead of failing closed). The password stage then interprets this false as a signal to skip the password stage entirely, allowing the attacker to proceed without providing a password.

The root cause is twofold:

1. Input Validation: The X-Forwarded-For header is not validated as a proper IP address early enough, leading to an unhandled exception.
2. Policy Binding Misconfiguration: The default blueprint does not set failure_result to True, causing the policy to fail open (skip the stage) instead of failing closed (deny access).

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

# In the password stage policy check
def check_password_stage(request):
    try:
        client_ip = request.headers.get('X-Forwarded-For')
        # No validation of client_ip as IP address
        # Later, when client_ip is used, it may cause an exception
        # ...
    except Exception:
        # Policy returns False due to missing failure_result=True
        return False
    return True

Patched Code (simplified):

# In the password stage policy check
def check_password_stage(request):
    try:
        client_ip = request.headers.get('X-Forwarded-For')
        # Validate client_ip as a proper IP address early
        if not is_valid_ip(client_ip):
            # Fail closed: deny access
            return False
        # ...
    except Exception:
        # Fail closed: deny access
        return False
    return True

The patch adds early validation of the X-Forwarded-For header to ensure it is a valid IP address. Additionally, the default blueprint is updated to set failure_result to True, ensuring that any policy failure results in denial of access.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• An authentik instance that trusts the X-Forwarded-For header (common in reverse proxy setups).
• Knowledge of a valid username or email address for an account.

Exploitation Steps:

1. Identify the target authentik instance (e.g., https://auth.example.com).
2. Send a POST request to the login endpoint with a valid username/email and a crafted X-Forwarded-For header containing an invalid IP address.

Example using curl:

curl -X POST https://auth.example.com/api/v3/stages/password/ \
  -H "Content-Type: application/json" \
  -H "X-Forwarded-For: a" \
  -d '{"username": "admin@example.com", "password": ""}'

3. If successful, the server will respond with a session token or redirect, indicating that the password stage was bypassed.

Note: The exact endpoint and parameters may vary based on authentik version and configuration. The attacker may need to first complete the identification stage to obtain a flow token.

Blue Team (Defender)

Detection:

• Monitor for requests with invalid X-Forwarded-For headers (e.g., non-IP strings like a, b, localhost, etc.).
• Look for authentication logs where the password stage is skipped unexpectedly.
• Alert on multiple failed login attempts followed by a successful login without a password.

Mitigation:

• Immediately upgrade to authentik 2024.8.3 or 2024.6.5.
• If upgrading is not possible, configure the reverse proxy to validate the X-Forwarded-For header before passing it to authentik.
• Set failure_result to True on all policy bindings in the authentik admin interface.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with X-Forwarded-For header containing non-IP values (e.g., a, b, test, null).
  • Unusual authentication patterns: successful logins without a password stage.
• Logs:
  • authentik audit logs showing password_stage_skipped events.
  • Application logs with exceptions related to IP address parsing (e.g., ValueError: 'a' does not appear to be an IPv4 or IPv6 address).
• System:
  • Unauthorized access to accounts with known usernames/emails.

Detection Engineering

YARA Rule

rule CVE_2024_47070_Authentik_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-47070 in authentik by looking for invalid X-Forwarded-For headers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47070"
    strings:
        $header = "X-Forwarded-For"
        $invalid_ip = /X-Forwarded-For:\s*[^0-9a-fA-F:.]/
    condition:
        $header and $invalid_ip
}

Sigma Rule

title: CVE-2024-47070 Authentik Authentication Bypass via Invalid X-Forwarded-For
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with invalid X-Forwarded-For headers targeting authentik login endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47070
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v3/stages/password/'
        cs-headers: 'X-Forwarded-For: *'
    filter:
        cs-headers: 'X-Forwarded-For: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
    condition: selection and not filter
falsepositives:
    - Legitimate misconfigured proxies
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47070 Authentik Authentication Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v3/stages/password/"; http_uri; content:"X-Forwarded-For"; http_header; pcre:"/X-Forwarded-For:\s*[^0-9a-fA-F:.]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade authentik to version 2024.8.3 or 2024.6.5. This is the only complete fix.
2. Validate X-Forwarded-For at the proxy level: If using a reverse proxy (e.g., Nginx, Apache), configure it to reject requests with invalid X-Forwarded-For headers before they reach authentik.
   • Example Nginx configuration:

     if ($http_x_forwarded_for !~ "^(\d{1,3}\.){3}\d{1,3}$") {
         return 403;
     }
     

3. Set failure_result to True: In the authentik admin interface, navigate to the policy binding for the password stage and ensure failure_result is set to True. This ensures that any policy failure results in denial of access.

Long-term Measures:

• Implement strict input validation for all HTTP headers.
• Regularly update authentik and other identity provider software.
• Monitor for unusual authentication patterns and header anomalies.

Workarounds (if patching is delayed):

• Disable the policy that skips the password stage if the identification stage includes a password field.
• Use a Web Application Firewall (WAF) to block requests with invalid X-Forwarded-For headers.

Report generated by Valters IT DevSecOps & CTI Expert System