Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-11T21:17:44.443Z",
  "pubdate": "2026-08-11T21:17:44.443Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Malcolm network traffic analysis tool suite prior to version 26.07.0.\nThe flaw stems from a discrepancy between path normalization in Nginx and the evaluation of raw, unnormalized request URIs within the Nginx OpenResty Lua layer responsible for role-based access control.\nAn authenticated low-privilege attacker can exploit this discrepancy to bypass security restrictions and gain unauthorized access to restricted backend routes.\nThe impact includes unauthorized access to sensitive application functionality and administrative endpoints reserved for higher privilege levels.\nExploitation requires authentication as a low-privilege user and network access to the target application.\nRisk implications are significant as it undermines the integrity of the role-based access control mechanism, allowing privilege escalation within the application context.\nRemediation requires upgrading the Malcolm software suite to version 26.07.0 or later, where the authorization logic has been corrected.",
  "technicalDetails": "The vulnerability resides in the Nginx OpenResty Lua layer responsible for enforcing role-based access control within the Malcolm application.\nThe root cause of the vulnerability is input discrepancy during URI processing: the Lua authorization script evaluates the raw, unnormalized ngx.var.request_uri, whereas Nginx routes the underlying HTTP request using its internally normalized path.\nThe affected component is the authorization enforcement mechanism within the Nginx OpenResty configuration prior to version 26.07.0.\nAuthentication and privilege requirements dictate that the attacker must possess a valid, low-privilege user session to interact with the endpoints.\nThe network exposure is tied to the web interface exposed by Malcolm.\nThe attack flow proceeds as follows: an authenticated low-privilege user crafts an HTTP request containing a directory traversal segment, such as /x/../upload/..., within the request URI. When the request hits the server, the Nginx OpenResty Lua layer inspects the raw ngx.var.request_uri for role-based access control decisions. Because the raw URI contains the traversal sequence and does not explicitly match predefined restricted routing rules, the Lua authorization check fails to match any explicit deny or restrict rule and incorrectly falls open, granting access. Concurrently, Nginx processes the request by normalizing the path, stripping the traversal segments, and successfully routing the request to the restricted backend functionality.\nPost-exploitation impact involves unauthorized interaction with sensitive backend endpoints, allowing low-privilege users to perform actions restricted to administrative or higher-privileged roles."
}