Critical Use-After-Free Vulnerability in Tinyproxy

CVE-2023-49606 is a critical use-after-free vulnerability affecting the Tinyproxy HTTP/S proxy server, specifically versions 1.10.0 and 1.11.1. The flaw resides within the http-message.c file, where the application manages memory allocation for HTTP header storage. When processing headers, specifically during the reallocation of memory for the header array, the application fails to safely handle pointers to old memory locations after they have been freed.

An unauthenticated remote attacker can supply crafted HTTP headers to trigger this memory corruption. Successful exploitation leads to a crash of the proxy process, resulting in a denial of service (DoS). Furthermore, due to the nature of use-after-free vulnerabilities in memory-unsafe environments, there is a potential for remote code execution (RCE) if an attacker can precisely manipulate the heap state. A proof-of-concept exploit script has been publicly disclosed on Sploitus, increasing the risk of exploitation for unpatched internet-facing proxy instances.

Impact

The vulnerability carries a CVSS score of 9.8, indicating high severity across confidentiality, integrity, and availability. Successful exploitation typically results in immediate service disruption (DoS). In environments where Tinyproxy is used as a gateway or intermediate proxy, potential RCE could grant attackers unauthorized access to the underlying server, facilitating lateral movement or further network compromise.

Recommendation

• Immediately audit network infrastructure to identify all instances of Tinyproxy 1.10.0 and 1.11.1.
• Patch or upgrade affected Tinyproxy instances to the latest available stable release that addresses CVE-2023-49606.
• Implement ingress filtering on the proxy to block abnormally large or malformed HTTP header sequences if immediate patching is not feasible.
• Monitor webserver and proxy error logs for frequent segmentation faults or abnormal process terminations associated with the Tinyproxy service.