4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-527g-3w9m-29hv

GHSA-527g-3w9m-29hv: LDAP Injection in mitmproxy

Impact

In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication.

Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default.

Patches

The vulnerability has been fixed in mitmproxy 12.2.2 and above.

Acknowledgements

We thank Yue (Knox) Liu (@yueyueL) for responsibly disclosing this vulnerability to the mitmproxy team.

Timeline

2025-12-08: Received initial report.
2025-12-09: Verified report and confirmed receipt.
2026-01-02: Informed researcher that patch will be part of the next regular patch release.
2026-04-12: Published patch release and advisory.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-527g-3w9m-29hv

GHSA-527g-3w9m-29hv:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mitmproxy	pip	<= 12.2.1	12.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the mitmproxy.addons.proxyauth.Ldap class, specifically within the __call__ method. The advisory states that the LDAP proxy authentication does not correctly sanitize the username. The provided patch confirms this. Before the patch, the username was directly embedded into an f-string to create an LDAP search filter: f"({self.filter_key}={username})". This is a classic LDAP injection vulnerability. The patch introduces a new method, make_search_filter, which uses ldap3.utils.conv.escape_filter_chars to sanitize the username before it is used to build the filter. The __call__ method is updated to use this new sanitization function, thus mitigating the vulnerability. Therefore, the mitmproxy.addons.proxyauth.Ldap.__call__ function is the vulnerable function that would be observed in a runtime profile during an exploitation attempt.

Vulnerable functions

mitmproxy.addons.proxyauth.Ldap.__call__

mitmproxy/addons/proxyauth.py

The `__call__` method in the `Ldap` class constructs an LDAP search filter using the `username` parameter without proper sanitization. A malicious user could provide a specially crafted username to inject arbitrary LDAP filter syntax, potentially bypassing authentication.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.