cleaniquecoders / kerberos-auth Goto Github PK

Hi there, just working on a kerberos integration and reviewing available packages. This one is listed as a laravel kerberos plugin but it's essentially a backdoor (unless your server setup is very particular).

Following the basic setup steps configures the application in such a way that adding an X-REMOTE-USER header to a request allows for an attacker to first probe a known route for a valid user and then gain instantaneous access upon discovery of a user.

I'm assuming that this is intended to be used behind a server which negotiates the kerberos auth for you and appends this header. If that's the case, this should be very central in the README! Without that header being pre-processed, this behaves as above.

EDITED as on re-reading this wasn't entirely clear that there is a use case, but the instructions are not beginner-friendly