CVE-2021-3116
📋 TL;DR
This vulnerability in proxy.py's authentication plugin allows attackers to bypass HTTP proxy authentication due to a boolean logic error. It affects proxy.py versions before 2.3.1 that use authentication plugins. Attackers can access protected proxy resources without valid credentials.
💻 Affected Systems
- proxy.py
📦 What is this software?
Proxy.py by Proxy.py Project
⚠️ Risk & Real-World Impact
Worst Case
Complete proxy authentication bypass allowing unauthorized access to internal network resources, data exfiltration, or use as pivot point for further attacks.
Likely Case
Unauthorized proxy access leading to credential theft, session hijacking, or bypassing network access controls.
If Mitigated
Limited impact if proxy only handles non-sensitive traffic or has additional authentication layers.
🎯 Exploit Status
Exploitation requires sending malformed Proxy-Authorization headers. Public proof-of-concept exists in advisory links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1 and later
Vendor Advisory: https://github.com/abhinavsingh/proxy.py/security/advisories
Restart Required: Yes
Instructions:
1. Update proxy.py: pip install --upgrade proxy.py>=2.3.1
2. Restart proxy service
3. Verify authentication works correctly
🔧 Temporary Workarounds
Disable authentication
allTemporarily disable proxy authentication if not required
Modify proxy configuration to remove auth plugins
Network filtering
allBlock malformed Proxy-Authorization headers at network perimeter
Configure WAF/IPS to detect and block invalid auth headers
🧯 If You Can't Patch
- Implement additional authentication layer (e.g., IP whitelisting, VPN)
- Monitor proxy logs for authentication failures and unusual access patterns
🔍 How to Verify
Check if Vulnerable:
Check proxy.py version and authentication configuration. Test with malformed Proxy-Authorization header containing incorrect credentials.Check Version:
python -c "import proxy; print(proxy.__version__)" or check pip list | grep proxy.pyVerify Fix Applied:
Test authentication with correct and incorrect credentials. Valid credentials should pass, invalid should fail.📡 Detection & Monitoring
Log Indicators:
- Authentication successes with invalid credentials
- Multiple failed auth attempts followed by success
- Unusual source IPs accessing authenticated resources
Network Indicators:
- HTTP requests with malformed Proxy-Authorization headers
- Traffic bypassing expected authentication flows
SIEM Query:
proxy_auth:success AND (user:invalid OR credentials:malformed)🔗 References
- https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication/
- https://github.com/abhinavsingh/proxy.py/pull/482/commits/9b00093288237f5073c403f2c4f62acfdfa8ed46
- https://pypi.org/project/proxy.py/2.3.1/#history
- https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication/
- https://github.com/abhinavsingh/proxy.py/pull/482/commits/9b00093288237f5073c403f2c4f62acfdfa8ed46
- https://pypi.org/project/proxy.py/2.3.1/#history
