CVE-2021-1009: 
NixOS vulnerability analysis and mitigation

A URL access filters bypass vulnerability was discovered in Alpine version 1.10.2, identified as CVE-2022-23553. The vulnerability affects both BlacklistUrlFilter and WhitelistUrlFilter components, which are designed to control access to different resources based on URL patterns (GitHub Security Lab).

The vulnerability stems from an insecure implementation where the filters compare request URIs using the String's startsWith method without proper URI canonicalization. The request URI contains raw and non-canonicalized versions of the URI, allowing paths like '/allowed/..;/blocked' to bypass the intended access controls. This affects both BlacklistUrlFilter and WhitelistUrlFilter components in the system (GitHub Security Lab).

The vulnerability can lead to access control bypasses and potentially enable the leakage of source code, particularly when protecting application code on executable WAR files. Attackers could potentially access restricted resources by manipulating the URL path (GitHub Security Lab).

The vulnerability can be exploited by crafting specific URLs that bypass the intended access controls. A proof of concept demonstrates that by using path traversal techniques with ';' characters (e.g., '/foo/..;/secret/secret.txt'), an attacker can access restricted files that should be blocked by the filter (GitHub Security Lab).

The issue was fixed in Alpine version 1.10.4, released on February 13, 2022. Users are advised to upgrade to this version or later to address the vulnerability (GitHub Security Lab).