-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mad-proxy | pip | <= 0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a bypass of the HTTP/HTTPS traffic interception in mad-proxy version 0.3 and older. The advisory mentions a patch in version 0.4, but no corresponding tag or commit could be found in the repository. The analysis is therefore based on the source code of the latest available version, which is consistent with the vulnerable version 0.3. The root cause of the vulnerability was identified in the request function within the mad_proxy/proxy_server.py file. This function is responsible for intercepting and blocking requests to certain domains. The vulnerability lies in the case-sensitive nature of the domain check: if domain in url:. An attacker can exploit this by using mixed-case characters in the domain name of the URL, which will not match the blocklist and thus bypass the filter. The vulnerable function is request as it contains this flawed logic.
requestmad_proxy/proxy_server.py