CVE-2023-49606
Published: 01 May 2024
Summary
CVE-2023-49606 is a critical-severity Use After Free (CWE-416) vulnerability in Tinyproxy Project Tinyproxy. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A use-after-free vulnerability exists in the HTTP Connection Headers parsing logic of Tinyproxy versions 1.11.1 and 1.10.0. The flaw, tracked as CWE-416, occurs when a specially crafted HTTP header causes the proxy to reuse previously freed memory, resulting in memory corruption that may be leveraged for remote code execution.
An unauthenticated attacker can trigger the issue by sending a malicious HTTP request over the network. No user interaction or credentials are required, and successful exploitation can yield full control over the affected Tinyproxy process, consistent with the CVSS 3.1 score of 9.8.
Public advisories from Talos Intelligence and the Debian LTS team, along with oss-security postings, document the issue and point to available updates for the affected releases. The EPSS score has remained at a high level of 0.7961 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53554
Vulnerability details
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution.…
more
An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.