SoupAuthManager Proxy-Authorization Credential Leak via Proxy Configuration Change

Executive Summary

SoupAuthManager in libsoup caches proxy authentication credentials without properly scoping them to the proxy authority. When the proxy configuration changes, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, potentially leaking credentials.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for proxy authentication headers being sent to unintended proxies. Inspect HTTP requests for Proxy-Authorization headers when proxy configurations change. Use tools like tcpdump or Wireshark to capture and analyze traffic during proxy transitions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to unauthorized access to sensitive login details if an attacker controls the new proxy server. It may expose credentials used for proxy authentication, compromising network security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to the unauthorized disclosure of proxy authentication credentials, which may include sensitive user or system login details. Such credential leaks could potentially violate data protection requirements under GDPR (e.g., Article 32 on security of processing) or HIPAA (e.g., safeguards for protected health information) if the leaked credentials grant access to systems handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Disable proxy credential caching in libsoup-based applications if possible. Avoid using proxy auto-configuration (WPAD) until a patch is available. Monitor network traffic for unauthorized credential transmissions and update libsoup to the latest patched version once released.

Useful 0 Not Useful 0