Labstack Echo: Proxy middleware WebSocket upgrade bypass

The Proxy middleware in Labstack Echo (v4 and v5) fails to validate if an upstream server successfully upgrades to a WebSocket connection. When an upstream server rejects a WebSocket upgrade request but keeps the underlying TCP connection open, Echo incorrectly maintains a raw tunnel. This state causes subsequent HTTP requests on that same connection to be forwarded directly to the upstream service, bypassing any Echo-level router logic or middleware (e.g., authentication, authorization).

Attack Chain

1. Attacker identifies a proxy route in an Echo-based application.
2. Attacker sends a WebSocket upgrade request (HTTP GET with Connection: Upgrade, Upgrade: websocket) to the proxy route.
3. The target upstream service receives the request, determines it cannot upgrade, and returns a standard HTTP response (e.g., 400 or 403) while keeping the connection alive.
4. Echo's Proxy middleware erroneously promotes the connection to a raw tunnel upon receiving the upgrade initiation, failing to confirm the upstream's non-101 response status.
5. Attacker sends subsequent unauthorized HTTP requests over the existing, now-tunneling connection.
6. The proxy forwards these requests directly to the upstream, bypassing route-level controls implemented in the Echo layer.

Impact

Unauthorized access to upstream resources that rely on Echo-level authentication or authorization. The bypass does not provide arbitrary-host proxying and relies on existing upstream reachability.

Recommendation

• Upgrade Echo to v4.16.1 or v5.4.1 immediately to implement upstream response validation.
• If immediate patching is not possible, enforce independent authentication and authorization checks at the upstream resource level.
• Implement request filtering at the perimeter or load balancer to block WebSocket upgrade requests if they are not explicitly required for specific routes.