Homepage

mitmproxy@2.0.1 vulnerabilities

An interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSockets.

  • latest version

    11.1.3

  • latest non vulnerable version

    11.1.3

  • first published

    13 years ago

  • latest version published

    2 months ago

  • licenses detected

  • View mitmproxy package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mitmproxy package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Unintended Proxy or Intermediary ('Confused Deputy')

    mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

    Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') through the proxy server configuration. An attacker can escalate unauthorized access and potentially execute arbitrary code by exploiting the proxy to route requests to the internal API.

    Notes:

    1. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected;

    2. This is only exploitable if the attacker is in the same local network.

    How to fix Unintended Proxy or Intermediary ('Confused Deputy')?

    Upgrade mitmproxy to version 11.1.2 or higher.

    [,11.1.2)
    • M
    HTTP Request Smuggling

    mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

    Affected versions of this package are vulnerable to HTTP Request Smuggling via another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

    How to fix HTTP Request Smuggling?

    Upgrade mitmproxy to version 8.0.0 or higher.

    [,8.0.0)
    • H
    HTTP Request Smuggling

    mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

    Affected versions of this package are vulnerable to HTTP Request Smuggling. A malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests.

    How to fix HTTP Request Smuggling?

    Upgrade mitmproxy to version 7.0.3 or higher.

    [,7.0.3)
    • H
    Command Injection

    mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

    Affected versions of this package are vulnerable to Command Injection. The command generated by export.clip curl @focus or export.file curl @Focus /path/to/file is not properly escaped so it can contain a malicious command.

    How to fix Command Injection?

    Upgrade mitmproxy to version 5.0.0 or higher.

    [,5.0.0)
    • H
    DNS Rebinding

    mitmproxy is An interactive, SSL-capable, man-in-the-middle HTTP proxy for penetration testers and software developers.

    Affected versions of this package are vulnerable to DNS Rebinding. The mitmweb interface did not include protection against DNS rebinding. This could be exploited by a malicious website to either access the sniffed data or run arbitrary Python scripts on the filesystem by setting the scripts config option.

    How to fix DNS Rebinding?

    Upgrade mitmproxy to version 4.0.4 or higher.

    [,4.0.4)
    Go back to all versions of this package