Orthanc HTTP Basic Auth Username Colon Injection Privilege Escalation

Vulnerability Key Information Vulnerability Title: Colons in HTTP basic usernames allow privilege escalation Vulnerability ID: Bug 252 Status: RESOLVED FIXED Reported Time: 2025-09-23 05:57 CEST Modified Time: 2025-09-23 10:37 CEST Product: Orthanc Component: Orthanc Core Version: unspecified Hardware: PC Linux Severity: normal Assignee: Sébastien Jodogne Vulnerability Description Details Issue: Users can impersonate other users by exploiting colons in HTTP basic usernames when using HTTP basic authentication and authorization filters. Cause: According to the specification, colons should not be allowed in HTTP basic usernames, but the actual code does not enforce this restriction. Example: When the username is "admin:user1", the authorization filter treats it as the "admin" user. Exploitation Condition: Requires an administrator to add suspicious usernames to the configuration; actual exploitation likelihood is low. Reproduction Steps 1. Configuration: 2. Lua Authorization Filter: 3. Test: Execute the script using the username "admin:abc123"; returns a 200 response instead of the expected 403. Expected Output vs Actual Output Expected: Should return a 403 error. Actual: Returns a 200 response, with the username being recognized as "admin". Environment Information Product Version: Docker image jodogne/orthanc-plugins:1.12.9 Operating System: Linux Fix Information Fix Commit: https://orthanc.uclouvain.be/hg/orthanc/rev/9e5bb00c0525

Goal Reached Thanks to every supporter — we hit 100%!

Orthanc HTTP Basic Auth Username Colon Injection Privilege Escalation