CVE-2023-49606: Tinyproxy < 1.11.2 - Use After Free in HTTP Connection Header

id: CVE-2023-49606

info:
  name: Tinyproxy < 1.11.2 - Use After Free in HTTP Connection Header
  author: DhiyaneshGeek
  severity: critical
  description: |
    A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.10.0 through 1.11.1. The remove_connection_headers() function in reqs.c frees a header value pointer that is subsequently reused during header iteration, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a specially crafted HTTP Connection header (e.g., Connection: Connection), causing proxy worker process crashes (denial of service) or potentially achieving remote code execution.
  impact: |
    An unauthenticated attacker can crash Tinyproxy worker processes remotely, causing denial of service. The use-after-free may be leveraged for remote code execution depending on heap layout and target architecture.
  remediation: |
    Upgrade Tinyproxy to version 1.11.2 or later. If building from source, apply commit 12a8484265f7b00591293da492bb3c9987001956 which copies the header value before iteration.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889
    - https://github.com/tinyproxy/tinyproxy/commit/12a8484265f7b00591293da492bb3c9987001956
    - https://nvd.nist.gov/vuln/detail/CVE-2023-49606
    - http://www.openwall.com/lists/oss-security/2024/05/07/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-49606
    cwe-id: CWE-416
    epss-score: 0.63076
    epss-percentile: 0.99214
  metadata:
    verified: true
    max-request: 1
    vendor: tinyproxy_project
    product: tinyproxy
    shodan-query: "Server: tinyproxy"
    fofa-query: header="tinyproxy"
  tags: cve,cve2023,tinyproxy,uaf,rce,passive,vkev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{randstr}}.invalid
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "tinyproxy"
        case-insensitive: true

      - type: dsl
        dsl:
          - compare_versions(version, '>= 1.10.0', '<= 1.11.1')

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        internal: true
        regex:
          - "(?i)Server: tinyproxy/([0-9]+\\.[0-9]+\\.[0-9]+)"

      - type: regex
        part: body
        group: 1
        regex:
          - "tinyproxy(?:</a>)? version ([0-9]+\\.[0-9]+\\.[0-9]+)"
# digest: 4b0a004830460221008270ccaaa4ccaa6b15bd6163749d7028f4c4a1f1da1336ac6756f8ce708f249e0221009a94017e41cdbe5c92b6b2aa1a89d94e54fed6f4e57db6be24b652612170b231:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.