goproxy through 15.3 Authentication Bypass via CONNECT
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.3%
probabilidade de exploração
0.3%top 81% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
snail007 · goproxyPoCs públicas encontradas — 1
cve_referencegithub.com/geo-chen/oss/blob/main/goproxy.mdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/geo-chen/oss/blob/main/goproxy.mdhttps://github.com/snail007/goproxyhttps://github.com/snail007/goproxy/blob/v15.3/services/http.gohttps://github.com/snail007/goproxy/blob/v15.3/utils/structs.gohttps://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect