Horizon Alert
Summary of the vulnerability and why it matters
The frp reverse proxy software is vulnerable due to an authentication bypass flaw when using specific HTTP vhost routing configurations. This weakness allows unauthorized access to protected backend services, even when credentials are not correctly provided. Organizations relying on this feature may face risks to their internal systems and data.
- Vulnerable frp reverse proxy routing.
- Authentication bypass allows unauthorized access.
- Potential exposure of protected backend services.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authentication when the frp HTTP vhost routing feature, specifically `routeByHTTPUser`, is in use. This occurs when the system checks credentials from one header while routing based on information from another. Attackers who can reach the HTTP vhost entrypoint and know the protected `routeByHTTPUser` value may gain unauthorized access to protected backends. This could impact organizations that use this specific access control feature.
- Exposed HTTP vhost entrypoint.
- Attacker guesses protected route value.
- Unauthenticated access to backend.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in the frp reverse proxy could allow an attacker to bypass authentication and access protected backends. Exploitation requires an attacker to reach the HTTP vhost entrypoint and possess or guess the value associated with a specific routing configuration. Organizations using this feature face a significant risk of unauthorized data access and system compromise.
- Attackers with low skill level.
- No authentication or network access needed.
- High business risk requires urgent attention.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An authentication bypass vulnerability in `frp` could allow attackers to access protected backends by manipulating routing logic. This occurs when specific access control configurations are in use, potentially exposing sensitive data or systems to unauthorized access. Organizations utilizing `frp` with the affected configurations should prioritize addressing this risk.
- Identify `frp` deployments using `routeByHTTPUser`.
- Isolate affected `frp` services.
- Apply vendor update and validate.
