# API Gateway / Reverse Proxy Security Detection Module

> API Gateway, reverse proxy configuration vulnerabilities, route bypass, Header injection

## Overview (High Priority)

API Gateways and reverse proxies often become attack entry points due to misconfiguration, leading to authentication bypass and internal service exposure.

---

## Detection Categories

### 1. Route Bypass (/api;/admin)

```nginx
# ❌ Nginx path normalization bypass
location /admin {
    deny all;
}

# Bypass: /admin;/ or /admin../ or /%61dmin
```

```yaml
# ❌ Spring Cloud Gateway path bypass
spring:
  cloud:
    gateway:
      routes:
        - id: admin
          uri: http://admin-service
          predicates:
            - Path=/admin/**  # Bypass: /admin;x/ or /./admin/
```

**Detection**:
```bash
grep -rn "location.*/(admin|internal|private)" nginx.conf
grep -rn "Path=.*/(admin|internal)" application.yml
```

**Security Fix**:
```nginx
# ✓ Exact match + normalization
location = /admin {
    deny all;
}

location ~ ^/admin/ {
    deny all;
}

# ✓ Add normalization
merge_slashes off;  # Prevent // bypass
```

### 2. Path Normalization Bypass (%2f, %5c)

```java
// ❌ Spring Security configuration bypass
http.authorizeRequests()
    .antMatchers("/admin/**").hasRole("ADMIN")
    .antMatchers("/api/**").permitAll();

// Bypass: /api/%2e%2e/admin → /admin (after URL decode)
```

**Detection**:
```bash
grep -rn "antMatchers\|regexMatchers" --include="*.java" -A 3
```

**Security Fix**:
```java
// ✓ Use StrictHttpFirewall
@Bean
public HttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedSlash(false);  // Prohibit %2f
    firewall.setAllowBackSlash(false);  // Prohibit \
    firewall.setAllowUrlEncodedPercent(false);  // Prohibit %25
    firewall.setAllowSemicolon(false);  // Prohibit ;
    return firewall;
}
```

### 3. Header Override (X-Original-URI / X-Rewrite-URL)

```nginx
# ❌ Trusting client headers
location / {
    proxy_pass http://backend;
    proxy_set_header X-Original-URI $request_uri;  # Client can forge
}
```

```java
// ❌ Backend trusting X-Original-URI for authorization
String originalUri = request.getHeader("X-Original-URI");
if (originalUri.startsWith("/admin")) {
    // Authorization logic - can be bypassed!
}
```

**Detection**:
```bash
grep -rn "proxy_set_header X-Original-URI\|X-Rewrite-URL" nginx.conf
grep -rn "getHeader.*X-Original-URI\|X-Rewrite-URL" --include="*.java"
```

**Security Fix**:
```nginx
# ✓ Clear client headers, only gateway sets them
proxy_set_header X-Original-URI "";  # Clear first
proxy_set_header X-Forwarded-URI $request_uri;  # Gateway sets
```

### 4. Internal Authentication Header Trust Issues

```nginx
# ❌ Gateway sets X-Authenticated-User but client can forge
location /api {
    proxy_set_header X-Authenticated-User $remote_user;  # Can be empty
    proxy_pass http://backend;
}
```

**Security Fix**:
```nginx
# ✓ Enforce authentication, only set header after auth
location /api {
    auth_request /auth;  # Authenticate first
    auth_request_set $user $upstream_http_x_user;
    proxy_set_header X-Authenticated-User $user;
    proxy_pass http://backend;
}
```

### 5. gRPC-Web → HTTP/JSON Translation Vulnerability

```yaml
# ❌ Envoy gRPC-JSON transcoder misconfiguration
http_filters:
  - name: envoy.filters.http.grpc_json_transcoder
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder
      services:
        - "*"  # Overly permissive, exposes all gRPC methods
      print_options:
        always_print_primitive_fields: true
```

**Detection**:
```bash
grep -rn "grpc_json_transcoder" envoy.yaml
grep -rn "services:.*\*" envoy.yaml
```

**Security Fix**:
```yaml
# ✓ Whitelist specific services
services:
  - "myapp.UserService"
  - "myapp.OrderService"
```

---

## Comprehensive Detection Checklist

### Critical
- [ ] Path traversal bypassing authentication (/admin;/ /admin../)
- [ ] Trusting client X-Original-URI for authorization

### High
- [ ] URL encoding bypass (%2f %5c)
- [ ] gRPC-JSON transcoder exposing all methods
- [ ] Gateway authentication headers forgeable by client

### Medium
- [ ] Path normalization configuration missing
- [ ] merge_slashes not disabled

---

## False Positives

- ✅ Internal management interfaces only accessible from localhost
- ✅ Temporary configurations in development environments
- ✅ Special handling for health check paths

---

## Minimal PoC Examples
```bash
# Path bypass (/admin;/)
curl -I "https://victim/admin;/" -H "X-Original-URI: /admin;/"

# Encoding bypass (%2f)
curl -I "https://victim/api/%2e%2e/admin"

# Header override
curl -I "https://victim/" -H "X-Original-URI: /admin"
```

---

## References

- OWASP: API Gateway Security
- Nginx Security Hardening
- Spring Security StrictHttpFirewall
- Envoy Proxy Security Best Practices
