CyberRota Analysis
AI-GeneratedCosmos versions prior to 0.22.19 are vulnerable to a bypass in the tokenMiddleware, allowing attackers with a valid x-cstln-auth API key to impersonate users by manipulating authentication headers. This vulnerability can lead to unauthorized access, enabling attackers to perform admin-level actions on proxied applications. Organizations using affected versions of Cosmos should prioritize upgrading to version 0.22.19 to mitigate the risk of user impersonation and potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.