Tinyproxy < 1.11.2 - Use After Free in HTTP Connection Header

criticalseverity

9.8CVSS score

80.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.10.0 through 1.11.1. The remove_connection_headers() function in reqs.c frees a header value pointer that is subsequently reused during header iteration, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a specially crafted HTTP Connection header (e.g., Connection: Connection), causing proxy worker process crashes (denial of service) or potentially achieving remote code execution.

Impact

An unauthenticated attacker can crash Tinyproxy worker processes remotely, causing denial of service. The use-after-free may be leveraged for remote code execution depending on heap layout and target architecture.

Fix

Upgrade Tinyproxy to version 1.11.2 or later. If building from source, apply commit 12a8484265f7b00591293da492bb3c9987001956 which copies the header value before iteration.

How to confirm it

Send: GET /
Positive when: contains in header "tinyproxy" AND compare_versions(version, '>= 1.10.0', '<= 1.11.1')

Run it with nuclei: nuclei -id CVE-2023-49606 -u <target>

The full check

id: CVE-2023-49606

info:
  name: Tinyproxy < 1.11.2 - Use After Free in HTTP Connection Header
  author: DhiyaneshGeek
  severity: critical
  description: |
    A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.10.0 through 1.11.1. The remove_connection_headers() function in reqs.c frees a header value pointer that is subsequently reused during header iteration, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a specially crafted HTTP Connection header (e.g., Connection: Connection), causing proxy worker process crashes (denial of service) or potentially achieving remote code execution.
  impact: |
    An unauthenticated attacker can crash Tinyproxy worker processes remotely, causing denial of service. The use-after-free may be leveraged for remote code execution depending on heap layout and target architecture.
  remediation: |
    Upgrade Tinyproxy to version 1.11.2 or later. If building from source, apply commit 12a8484265f7b00591293da492bb3c9987001956 which copies the header value before iteration.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889
    - https://github.com/tinyproxy/tinyproxy/commit/12a8484265f7b00591293da492bb3c9987001956
    - https://nvd.nist.gov/vuln/detail/CVE-2023-49606
    - http://www.openwall.com/lists/oss-security/2024/05/07/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-49606
    cwe-id: CWE-416
    epss-score: 0.80903
    epss-percentile: 0.99636
  metadata:
    verified: true
    max-request: 1
    vendor: tinyproxy_project
    product: tinyproxy
    shodan-query: "Server: tinyproxy"
    fofa-query: header="tinyproxy"
  tags: cve,cve2023,tinyproxy,uaf,rce,passive,vkev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{randstr}}.invalid
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "tinyproxy"
        case-insensitive: true

      - type: dsl
        dsl:
          - compare_versions(version, '>= 1.10.0', '<= 1.11.1')

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        internal: true
        regex:
          - "(?i)Server: tinyproxy/([0-9]+\\.[0-9]+\\.[0-9]+)"

      - type: regex
        part: body
        group: 1
        regex:
          - "tinyproxy(?:</a>)? version ([0-9]+\\.[0-9]+\\.[0-9]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from