Bastillion Authentication Bypass via URI Path Validation Flaw

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing an authentication bypass by prefixing requests with arbitrary path segments to evade authentication filters.

Unauthenticated attackers can access administrative controllers to:

• Read user listings
• Create manager accounts
• Register managed systems
• Gain control over SSH access to the managed fleet