NuGet · Steeltoe.Management.Endpoint
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.
An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.
Management:Endpoints:Port is configured to a value different from the application's main listener port.Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.If an immediate upgrade to a patched version is not possible:
RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.Host header value and prevent clients from setting an arbitrary port.Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.