Executive brief
goproxy is an HTTP/HTTPS proxy server used to relay and control network traffic. A flaw in its authentication logic allows unauthenticated clients to bypass credential checks when making HTTPS requests through a proxy configured with basic authentication. An attacker can tunnel arbitrary traffic through the proxy without providing a password, potentially accessing restricted destinations and exposing the proxy operator's IP address.
Technical details
The vulnerability is an authentication bypass (CWE-306) in the HTTP proxy request handling code. The root cause lies in utils/structs.go where the HTTPS() method processes CONNECT tunnel requests without invoking the BasicAuth() check that is applied to plain HTTP requests. While the HTTP() method properly enforces authentication when configured, the HTTPS() method for CONNECT tunnels bypasses all credential verification and immediately returns HTTP 200 Connection established. An attacker with network access to the proxy can issue CONNECT requests to any destination without providing credentials, allowing arbitrary TCP traffic relay. The vulnerability affects goproxy through version 15.3 and requires only network reachability to the proxy listener; no authentication credentials or user interaction is needed.
Affected products
- snail007 goproxy through 15.3
Timeline
- 2026-09-14: disclosed