Red Hat OpenShift Router X-SSL-Client Header Bypass Vulnerability Allowing mTLS Impersonation

A vulnerability exists in the OpenShift Router's HTTP frontend when the 'insecureEdgeTerminationPolicy' is set to Allow. The frontend fails to remove 'X-SSL-Client-*' headers from incoming plain HTTP requests. This oversight allows an unauthenticated attacker to send crafted requests that bypass backends relying on these headers for mutual TLS authentication, enabling impersonation of client certificate identities.

Impact

Exploitation of this vulnerability can lead to unauthorized bypassing of mutual TLS authentication, allowing attackers to impersonate client certificate identities on the affected backend services.