In Eclipse BaSyx Go Components (<=1.0.0), the ABAC middleware and the HTTP router handle trailing slashes inconsistently. The router uses Chi's middleware.StripSlashes to normalize request paths by removing trailing slashes before dispatching to handlers. However, the ABAC middleware evaluates the original request path including the trailing slash. If the ABAC middleware does not find a matching route with the trailing slash, it passes the request onward without enforcing authorization. The router then strips the slash and executes the protected handler without the intended ABAC authorization decision or query filters. This flaw allows an unauthenticated or unauthorized attacker to bypass ABAC policies by appending a trailing slash to API routes, potentially leading to unauthorized access or modification of resources. The vulnerability affects ABAC-enabled deployments of various Eclipse BaSyx services and is resolved in version 1.0.1.

An attacker without authentication or proper authorization can bypass Attribute-Based Access Control (ABAC) protections by exploiting the trailing slash inconsistency. This can lead to unauthorized read, create, update, delete, or upload operations on protected API endpoints. The vulnerability has a CVSS score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability of affected services.

A fix is available in Eclipse BaSyx Go Components version 1.0.1. Users should upgrade to version 1.0.1 or later to resolve this authorization bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.