Access Control: gRPC Authentication Bypass

A Google Remote Procedure Call (gRPC) Metadata object is created from an untrusted source.

The Metadata class is often used to house header data for an underlying protocol used by Google Remote Procedure Call (gRPC). When implementing the io.grpc.ServerInterceptor class, the Metadata object should be validated before passing to the next io.grpc.ServerCallHandler object. Especially when the Metadata object has caller identity.

Example 1: The following code shows user controllable data used as input to a gRPC Metadata object which is not validated before passing to the next io.grpc.ServerCallHandler object:

class PotentialAuthByPassInterceptor implements ServerInterceptor {
    @Override
    public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(ServerCall<ReqT, RespT> call, Metadata metadata, ServerCallHandler<ReqT, RespT> next) {
        return Contexts.interceptCall(Context.current(), call, metadata, next);
    }
}