CVE-2022-25850
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in the hoppscotch/proxyscotch package when interceptor mode is set to proxy. It allows attackers to make the backend server send HTTP requests to arbitrary URLs, potentially leaking sensitive information from the server. Users of affected versions of the proxyscotch package are vulnerable.
💻 Affected Systems
- github.com/hoppscotch/proxyscotch
📦 What is this software?
Proxyscotch by Proxyscotch Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of backend server credentials, access to internal services, and data exfiltration from cloud metadata services or internal APIs.
Likely Case
Information disclosure from internal services, potential access to cloud metadata, and reconnaissance of internal network.
If Mitigated
Limited to port scanning and basic network reconnaissance if proper network segmentation and input validation are in place.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and require minimal technical skill when accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0 and later
Vendor Advisory: https://github.com/hoppscotch/proxyscotch/commit/de67380f62f907f201d75854b76024ba4885fab7
Restart Required: Yes
Instructions:
1. Update package to version 1.0.0 or later using 'go get github.com/hoppscotch/proxyscotch@v1.0.0' 2. Rebuild and redeploy application 3. Restart services using the package
🔧 Temporary Workarounds
Disable proxy interceptor mode
allDisable the vulnerable interceptor mode configuration
Set interceptor mode to any value other than 'proxy' in configuration
Implement URL validation
allAdd input validation to restrict URLs that can be requested
Implement allowlist of permitted domains/URLs in application code
🧯 If You Can't Patch
- Implement network segmentation to restrict outbound connections from affected servers
- Deploy web application firewall (WAF) rules to detect and block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check go.mod or package dependencies for github.com/hoppscotch/proxyscotch version below 1.0.0Check Version:
go list -m github.com/hoppscotch/proxyscotchVerify Fix Applied:
Verify package version is 1.0.0 or higher using 'go list -m github.com/hoppscotch/proxyscotch'📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from backend server to internal IPs or cloud metadata endpoints
- Requests to unexpected domains from server process
Network Indicators:
- HTTP traffic from backend servers to internal network segments or cloud metadata services
SIEM Query:
source_ip=backend_server AND (dest_ip=169.254.169.254 OR dest_ip IN internal_ranges) AND protocol=http🔗 References
- https://github.com/hoppscotch/proxyscotch/commit/de67380f62f907f201d75854b76024ba4885fab7
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228
- https://github.com/hoppscotch/proxyscotch/commit/de67380f62f907f201d75854b76024ba4885fab7
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228
