Miggo Logo
Miggo Vulnerability Database
→
GHSA-xjv7-6w92-42r7

GHSA-xjv7-6w92-42r7: marimo vulnerable to proxy abuse of /mpl/{port}/

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-xjv7-6w92-42r7
EPSS Score
-
CWE
CWE-441
Published
10/1/2025
Updated
10/1/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
marimopip> 0.9.20, < 0.16.40.16.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability, identified as GHSA-xjv7-6w92-42r7, is a proxy abuse issue in the /mpl/{port}/ endpoint of the marimo package. My analysis of the provided patch commit 0312706d5e594acdb405209b2c8d87c98f46b22b confirms this.

The root cause of the vulnerability was the _create_mpl_proxy_middleware function in marimo/_server/main.py. This function set up a proxy that forwarded requests made to /mpl/<port>/... to http://localhost:<port>/.... The critical flaw was in the nested mpl_target_url function, which extracted the port number directly from the URL path without any authentication or validation. This allowed an unauthenticated attacker to craft requests to arbitrary ports on the machine running the marimo server, potentially accessing sensitive internal services.

The patch addresses this vulnerability by completely removing the _create_mpl_proxy_middleware function and its associated middleware from the application setup in create_starlette_app. It replaces this functionality with a new, more secure routing mechanism defined in marimo/_server/api/endpoints/mpl.py. The new implementation uses a dictionary figure_endpoints to map a figure number to a legitimate port, preventing attackers from specifying arbitrary ports in the URL. The new _mpl_handler function now checks if a requested figure number is authorized before proxying the request.

Based on this analysis, the primary vulnerable function that would appear in a runtime profile during exploitation is the mpl_target_url function, which is nested within _create_mpl_proxy_middleware. The _create_mpl_proxy_middleware function itself is the source of the vulnerability as it is responsible for creating and configuring the insecure proxy middleware.

Vulnerable functions

_create_mpl_proxy_middleware
marimo/_server/main.py
This function creates and configures a `ProxyMiddleware` for the `/mpl` endpoint. The vulnerability lies within the nested `mpl_target_url` function, which is passed as the `target_url` argument to the middleware. This nested function extracts a port number directly from the request path and uses it to construct a target URL to `localhost`. Since there is no validation of the port number, an attacker can specify any port on the local machine, allowing them to proxy requests to internal services that are not intended to be publicly accessible.
mpl_target_url
marimo/_server/main.py
This nested function is the runtime indicator of the vulnerability. During an exploit attempt, this function is called by the `ProxyMiddleware` to determine the target URL for the proxy. It parses the request path, extracts the port number without any validation, and returns a target URL pointing to `http://localhost:{port}`. This allows an attacker to scan and interact with any open port on the local machine where the marimo server is running. A profiler would likely show this function (or a reference to it, like `_create_mpl_proxy_middleware.<locals>.mpl_target_url`) in the stack trace when the vulnerable endpoint is accessed.

WAF Protection Rules

WAF Rule

### Summ*ry T** `/mpl/<port>/<rout*>` *n*point, w*i** is ****ssi*l* wit*out *ut**nti**tion on ****ult M*rimo inst*ll*tions *llows *or *xt*rn*l *tt**k*rs to r**** int*rn*l s*rvi**s *n* *r*itr*ry ports. ### **t*ils T*is rout* is us** int*rn*lly to p

Reasoning

T** vuln*r**ility, i**nti*i** *s **S*-xjv*-*w**-**r*, is * proxy **us* issu* in t** `/mpl/{port}/` *n*point o* t** `m*rimo` p**k***. My *n*lysis o* t** provi*** p*t** *ommit `****************************************` *on*irms t*is. T** root **us* o*