Description

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T16:17:03.320Z",
  "pubdate": "2026-10-12T16:17:03.320Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in tobychui/zoraxy versions up to 3.3.4. The flaw resides within the Path Exception Matcher component, specifically affecting the handleBasicAuth function in mod/dynamicproxy/authProviders.go.\nThe vulnerability allows remote, unauthenticated attackers to bypass basic authentication requirements by manipulating the PathPrefix argument. This enables unauthorized access to restricted resources typically protected by the dynamic proxy's authentication mechanism.\nThe risk is elevated due to the availability of public exploits, necessitating immediate remediation to prevent unauthorized data access or service manipulation. Systems running affected versions are susceptible to remote exploitation without requiring prior valid credentials.",
  "technicalDetails": "The vulnerability is an authentication bypass resulting from improper input validation within the Path Exception Matcher. The root cause is located in the handleBasicAuth function within the file mod/dynamicproxy/authProviders.go, which fails to correctly sanitize or validate the PathPrefix parameter used during the request authorization process.\nDuring the request handling cycle, the dynamic proxy evaluates incoming traffic against defined path exceptions to determine if authentication is required. By injecting a crafted PathPrefix argument, an attacker can manipulate the path matching logic to effectively neutralize the basic authentication gatekeeper. This allows the request to be processed as if it were an exempted or authorized route, despite lacking valid credentials.\nThe attack flow initiates when a remote user sends a crafted HTTP request to the Zoraxy instance. The request includes a specific PathPrefix that causes the Path Exception Matcher to incorrectly resolve the request's authorization context. Because the handleBasicAuth function does not strictly verify the relationship between the requested path and the associated authorization rules, the logic falls through to a permissive state.\nThis exploitation requires network access to the Zoraxy instance but does not require the attacker to possess pre-existing credentials. The post-exploitation impact includes the circumvention of security controls, potentially granting the attacker access to administrative interfaces, sensitive proxies, or backend services that were intended to be protected by Basic Authentication. Given that the exploit is publicly available, the attack surface is considered active and high-risk.\nThe vulnerability is restricted to versions up to 3.3.4. The fix requires upgrading to version 3.3.5-rc1 or applying the specific patch identified as 37cd0f27b17cd15cfa4af409bfec943146f5fdfe, which corrects the logic error in the Path Exception Matcher to ensure that path prefixes are evaluated against a secure whitelist or strict regex validation rather than being susceptible to manipulation."
}