Homepage
About Snyk

mitmproxy@3.0.3 vulnerabilities

An interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSockets.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the mitmproxy package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
HTTP Request Smuggling

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

Affected versions of this package are vulnerable to HTTP Request Smuggling via another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

How to fix HTTP Request Smuggling?

Upgrade mitmproxy to version 8.0.0 or higher.

[,8.0.0)
  • H
HTTP Request Smuggling

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

Affected versions of this package are vulnerable to HTTP Request Smuggling. A malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests.

How to fix HTTP Request Smuggling?

Upgrade mitmproxy to version 7.0.3 or higher.

[,7.0.3)
  • H
Command Injection

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

Affected versions of this package are vulnerable to Command Injection. The command generated by export.clip curl @focus or export.file curl @Focus /path/to/file is not properly escaped so it can contain a malicious command.

How to fix Command Injection?

Upgrade mitmproxy to version 5.0.0 or higher.

[,5.0.0)
  • H
DNS Rebinding

mitmproxy is An interactive, SSL-capable, man-in-the-middle HTTP proxy for penetration testers and software developers.

Affected versions of this package are vulnerable to DNS Rebinding. The mitmweb interface did not include protection against DNS rebinding. This could be exploited by a malicious website to either access the sniffed data or run arbitrary Python scripts on the filesystem by setting the scripts config option.

How to fix DNS Rebinding?

Upgrade mitmproxy to version 4.0.4 or higher.

[,4.0.4)
Go back to all versions of this package