CVE-2025-23217
Published: 06 February 2025
Summary
CVE-2025-23217 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wikipedia (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 12.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
mitmweb, the web-based interface for the mitmproxy interactive TLS-capable intercepting HTTP proxy, contains an access-control flaw in versions 11.1.1 and below. A client that can reach the proxy listener (bound to *:8080 by default) can route requests through it to reach the internal mitmweb API listener (bound to 127.0.0.1:8081 by default). The mitmproxy and mitmdump front-ends are unaffected; the issue is limited to mitmweb and is tracked under CWE-288 and CWE-441.
An unauthenticated remote attacker positioned to send traffic to the proxy can therefore reach otherwise protected API endpoints. The advisory notes that this server-side request forgery vector may be escalated to remote code execution, although the precise exploitation steps are not detailed in the provided references.
The vulnerability is resolved in mitmproxy 11.1.2; the changelog and GitHub Security Advisory GHSA-wg33-5h85-7q5p both direct users to upgrade, stating that no workarounds are known. The current and peak EPSS scores remain at 0.0358 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3147
Vulnerability details
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default)…
more
to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
Users can identify logons via alternate paths or channels by reviewing the previous logon time.
Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
Centralized IdPs close alternate authentication paths that enable bypass.
Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.
Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.
Mitigates confused deputy risks by ensuring distinct privilege domains so one partition cannot unintentionally act on behalf of another.