OTRS Community Edition Authentication Bypass via Remote-User Header

The OTRS Community Edition HTTP Basic Authentication modules in version 6 and earlier accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables, so an unauthenticated remote attacker can supply a crafted Remote-User header exposed as HTTP_REMOTE_USER.

When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and skips password verification. This authentication bypass lets an attacker authenticate through the Generic Interface as an existing agent or customer without knowing their credentials.

• Affected: OTRS Community Edition 6.x and earlier; derived products are also likely affected.
• Not affected: OTRS 7 and later, which use Mojolicious/Hypnotoad and do not expose arbitrary request headers through %ENV.
• Preconditions: HTTP Basic Authentication must be configured as the authentication backend, and the web server must expose attacker-controlled HTTP headers as HTTP_* environment variables.
• Impact: Depending on the impersonated account, an attacker may access confidential information and modify data or configuration with that user's permissions.