Authentication Bypass in Fiddler Everywhere Local Backend

Executive Summary

This vulnerability involves missing authentication in the local .NET backend of Progress Software Fiddler Everywhere 8.0.2. A local unauthenticated attacker can exploit this to mint OAuth tokens and access the machine-in-the-middle root certificate through unauthenticated localhost HTTP and SignalR RPC channels.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to Fiddler Everywhere's local backend by monitoring localhost HTTP and SignalR RPC traffic on port 8866. Look for unexpected OAuth token generation or certificate access attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive data, impersonate users via OAuth tokens, or decrypt intercepted traffic using the exposed root certificate. This could lead to data breaches or man-in-the-middle attacks on the local system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to breaches of GDPR or HIPAA. Organizations using Fiddler Everywhere may face penalties for failing to protect personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Fiddler Everywhere to the latest version. Disable local network access to the application if not required. Restrict SignalR RPC endpoints to localhost only.

Useful 0 Not Useful 0