Executive brief
XX-Net, a popular web proxy tool, contains a flaw in how it handles certain web communication (WebSocket) traffic. An attacker can send specially crafted messages that cause the application to misinterpret data, leading to information corruption. While the risk is generally low because the service typically only listens to local connections, it could impact data integrity if remote access is enabled.
Technical details
A vulnerability exists in the WebSocket_receive_worker routine within simple_http_server.py due to improper validation of the MASK bit as required by RFC 6455. The server unconditionally reads 4 bytes as a masking key even if the MASK bit is not set. This causes the first 4 bytes of the actual payload to be consumed as the key, while the remaining payload is incorrectly XOR-decoded, leading to data corruption. Additionally, the implementation lacks validation for RSV bits, opcodes, and FIN fragmentation. The vulnerability is primarily reachable via the local interface (127.0.0.1) unless 'Allow Remote' is explicitly enabled. A fix was introduced in commit a68b972.
Affected products
- XX-Net XX-Net <= 5.16.6
Timeline
- 2025-08-26: other: Version 5.16.6 released
- 2026-05-09: disclosed: Issue reported on GitHub
- 2026-05-12: patched: Fix merged into master branch
- 2026-05-29: advisory: CVE published