fix path cleaning of proxied urls by sanikachavan5 · Pull Request #22671 · hashicorp/consul

sanikachavan5 · 2025-08-31T17:42:01Z

Description

This pull request addresses a security issue in the UIMetricsProxy handler by improving how proxied URL paths are cleaned and validated to prevent path traversal attacks. The main focus is on ensuring that user-supplied paths cannot escape the intended base URL, even in edge cases.

Security improvements to URL path handling:

Paths are now cleaned using path.Clean with a leading slash to ensure that any ../ segments are properly removed, preventing path traversal attacks. (agent/ui_endpoint.go)
The previous redundant cleaning of the parsed URL path after construction has been removed, as the cleaning is now handled earlier and more securely. (agent/ui_endpoint.go)

Base URL validation enhancements:

The check for whether the target URL is within the base URL now ensures the base URL has a trailing slash for proper prefix matching, and allows an exact match of the base URL without the trailing slash. This prevents attackers from escaping the base path by manipulating the URL. (agent/ui_endpoint.go)

Testing & Reproduction steps

Links

PR Checklist

updated test coverage
external facing docs updated
appropriate backport labels added
not a security concern

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

Vikramarjuna · 2025-09-02T06:56:16Z

agent/ui_endpoint.go

 	// handler, can't backtrack far enough to eat into the BaseURL either. But we
 	// leave this in anyway in case something changes in the future.
-	if !strings.HasPrefix(u.String(), cfg.BaseURL) {
+


can we add UT for this

krutibaraiya · 2025-09-04T11:28:55Z

.changelog/22671.txt

Nit : security: Fixed proxied URL path validation to prevent path traversal.

dduzgun-security

Thanks a lot for working on this, I've added few comments on the PR to review

agent/ui_endpoint.go

dduzgun-security

LGTM, thanks for addressing the comments.

* fix path cleaning of proxied urls * add changelog * added more tests * add tests and address review comments * address review changes

hc-github-team-consul-core · 2025-09-23T09:17:38Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-24T09:18:41Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-25T09:18:24Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-26T09:18:36Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-28T09:18:20Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-29T09:20:21Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-09-30T09:19:00Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-01T09:19:18Z

📣 Hi @sanikachavan5! a backport is missing for this PR [22671] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2026-01-23T09:32:01Z