Description

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-14T22:16:58.880Z",
  "pubdate": "2026-09-14T22:16:58.880Z",
  "executiveSummary": "The vulnerability identified in goproxy (through version 15.3) is an authentication bypass issue specifically affecting HTTP CONNECT tunnel requests.\nThis flaw allows unauthenticated remote attackers to circumvent credential requirements intended to gatekeep proxy access.\nBy failing to enforce Basic Authentication for the CONNECT method, the proxy erroneously permits unauthorized clients to establish tunnels to arbitrary destinations.\nThe impact is significant, as it enables attackers to relay arbitrary TCP traffic through the proxy infrastructure, effectively bypassing network access controls and security policies.\nThis vulnerability exposes internal resources to external threats and facilitates man-in-the-middle operations, scanning, and traffic obfuscation.\nExploitation does not require prior authentication, meaning any attacker with network visibility to the proxy can leverage this flaw.\nThe risk implication is high, particularly for organizations relying on goproxy for perimeter security or traffic auditing, as it renders the authentication mechanism ineffective for its primary purpose.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authentication logic within the goproxy request handling pipeline, specifically concerning HTTP CONNECT tunnels. While goproxy is designed to enforce HTTP Basic Authentication for standard requests, it fails to extend this mandate to the establishment of TCP tunnels via the CONNECT method.\nUnder normal operating conditions, an authenticated proxy should intercept the CONNECT request, validate the Proxy-Authorization header, and only proceed to establish the downstream connection if credentials are verified. In affected versions (through 15.3), the proxy processes the CONNECT request without triggering the authentication middleware, allowing the tunnel to be established regardless of the presence or validity of authentication credentials.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP CONNECT request to the vulnerable goproxy instance, targeting a desired destination server (e.g., 'CONNECT target-host:port HTTP/1.1'). Because the proxy fails to validate authentication for CONNECT tunnels, it immediately initiates a TCP connection to the specified target-host:port. Once the downstream connection is established, the proxy returns a '200 Connection Established' response to the attacker. At this stage, the attacker possesses an unauthenticated full-duplex tunnel through the proxy.\nBecause the proxy is now acting as an open relay, the attacker can transmit arbitrary binary TCP traffic over this tunnel. This enables the attacker to interact with restricted services—including internal network resources, databases, or management interfaces—that are typically protected by network-level access controls or the proxy's intended authentication gates. Furthermore, this behavior masks the attacker's true source IP, as all traffic appears to originate from the goproxy instance.\nThis vulnerability persists because the proxy logic treats CONNECT requests as distinct from standard GET/POST requests regarding authentication enforcement, likely due to a design oversight in how the proxy handles protocol-level upgrades and tunneling. The vulnerability is present in all goproxy versions up to and including 15.3. Exposure is limited only by network reachability to the proxy's listening port. Post-exploitation, an attacker can perform reconnaissance, exfiltrate data, or interact with services behind the proxy, effectively bypassing any security boundary the proxy was meant to enforce."
}