Executive Summary

This vulnerability exists in Tinyproxy versions through 1.11.3, where the software fails to properly validate the Host header during stathost detection. This flaw allows unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection through port manipulation.

As a result, remote attackers can gain unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections, thereby circumventing access controls.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to internal proxy statistics, which may expose sensitive operational information about the proxy server.

Additionally, attackers can misroute requests by exploiting the transparent proxy connection mechanism, potentially bypassing access controls and security policies.

Useful 0 Not Useful 0