In affected versions, unauthenticated remote attackers can bypass these security requirements by specifically crafting CONNECT requests to tunnel arbitrary TCP traffic. This allows attackers to leverage the proxy as an unauthorized relay to reach restricted internal network segments or to mask the origin of their traffic for external C2 communication. The issue is significant for any infrastructure relying on goproxy as a gateway, as it effectively nullifies access control policies. Defenders should identify goproxy deployments in their environment and update to a patched version that correctly enforces authentication checks for all request types, including tunnels.

Impact

Successful exploitation allows unauthenticated attackers to establish arbitrary TCP tunnels through the goproxy server. This facilitates unauthorized access to internal resources otherwise protected by the proxy, enables attackers to exfiltrate data through a trusted egress point, and allows for the masking of C2 traffic. Organizations relying on this library for secure gateway, filtering, or inspection services are at risk of complete access control circumvention.

Recommendation

• Upgrade all instances of the goproxy package to a version beyond 15.3 immediately to ensure CONNECT requests properly trigger authentication headers.
• Review network egress logs for a high volume of CONNECT requests originating from unidentified clients if the proxy is exposed to the internet.
• Implement network-level restrictions using firewall rules to limit which source IP addresses are permitted to reach the goproxy instance if authentication cannot be immediately patched.