From fa46c294c8239534472a140293125864c0ea857d Mon Sep 17 00:00:00 2001 From: omnom62 Date: Sat, 12 Sep 2026 07:22:16 +1000 Subject: https: T8989: fix X-Client-Verify header passthrough auth bypass Always set proxy_set_header X-Client-Verify unconditionally so a client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS authentication when mTLS is not configured. When mTLS is disabled, nginx sets X-Client-Verify to empty string which correctly fails the == 'SUCCESS' check in auth_required. Fixes: GHSA-4w7q-wwx4-6973 --- data/templates/https/nginx.default.j2 | 2 -- 1 file changed, 2 deletions(-) (limited to 'data/templates/https/nginx.default.j2') diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2 index 0f1a79ad7..49134d5ab 100644 --- a/data/templates/https/nginx.default.j2 +++ b/data/templates/https/nginx.default.j2 @@ -62,10 +62,8 @@ server { proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600; proxy_buffering off; -{% if certificates.mtls_ca_path is vyos_defined %} proxy_set_header X-Client-Verify $ssl_client_verify; proxy_set_header X-Client-DN $ssl_client_s_dn; -{% endif %} {% else %} return 503; {% endif %} -- cgit v1.2.3