CVE-2025-64484 PoC — OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

Source

https://github.com/B1ack4sh/Blackash-CVE-2025-64484

Associated Vulnerability

Title:OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation (CVE-2025-64484)
Description:OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.

Description

CVE-2025-64484

Readme

# 🔐 CVE-2025-64484 — OAuth2-Proxy Header Normalization Vulnerability

<img width="1200" height="589" alt="G5zy5OwbkAExGgS" src="https://github.com/user-attachments/assets/60775348-6781-40d6-8e2b-edb85d8fe2fb" />

### 🧩 **What Is It?**

A **High-severity** vulnerability in **OAuth2-Proxy** (versions **< 7.13.0**) caused by inconsistent treatment of header names that use:

* `-` dashes
* `_` underscores

Attackers can sneak malicious headers through by switching dashes ↔ underscores.
This may bypass intended protections 🚨

---

## ⚠️ **Why It Matters**

* **Severity:** 🔥 **CVSS 8.5** (High)
* **Who’s affected:** Any service using OAuth2-Proxy in front of an app that *normalizes underscores and dashes* (e.g., Django, Flask, PHP apps).
* **Risk:**

  * 🆔 Identity spoofing
  * 🔓 Privilege escalation
  * 🎭 Manipulating trusted “forwarded” headers

OAuth2-Proxy itself isn’t “broken” — but it can unintentionally pass attacker-controlled headers to upstream apps.

---

## 🛡️ **How to Fix It**

### ✅ **1. Upgrade**

Update to **OAuth2-Proxy 7.13.0 or later** ✔️
This fully patches the issue.

### 🧰 **2. Temporary Mitigations** (if you cannot upgrade)

* Ensure your upstream app **does not treat `_` and `-` as equivalent**
* Add strict header filtering or normalization rules
* Use new config option `InsecureSkipHeaderNormalization` carefully 🔧

---

### How to Use CVE-2025-64484.py

#### 1. Save the file

```bash
sudo git clone https://github.com/B1ack4sh/Blackash-CVE-2025-64484.git
chmod +x CVE-2025-64484.py
```

#### 2. Run Against Your Vulnerable Lab (port 4180)

```
python3 CVE-2025-64484.py http://localhost:4180/
```

#### 3. Run Against Patched (port 4181)

```
python3 CVE-2025-64484.py http://localhost:4181/
```

**Expected Output**
Vulnerable (v7.12.0)

```
[+] Status: 200
🎯 [EXPLOIT SUCCESS] Authenticated as: admin@pwned.local
```

Patched (v7.13.0)

```
[-] Exploit failed. Header not reflected.
```

---

## 🔍 **Technical Insight (Simplified)**

Think of it like this:

🔐 **OAuth2-Proxy blocks dangerous headers**
but
🎭 **Attacker renames them using `_` instead of `-`**
and
📨 **The backend silently changes `_` → `-` — restoring the dangerous header**

Result: A sneaky bypass. 😈

---

## ⚠️ Disclaimer !!!

Educational use **only**. Test **solely on systems you own**. **Never** use on production, third-party, or unauthorized targets. **You** are responsible for compliance.

File Snapshot


 [4.0K]  /data/pocs/32e59226a62e42637b52df9e9a30e8bf65f6161d
├── [3.2K]  CVE-2025-64484.py
└── [2.4K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!