Weakness (CWE)
CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Enforce the use of strong mutual authentication mechanism between the two parties.
-
Architecture and Design
Whenever a product is an intermediary or proxy for
transactions between two other components, the proxy core
should not drop the identity of the initiator of the
transaction. The immutability of the identity of the
initiator must be maintained and should be forwarded all the
way to the target.
Source: MITRE CWE-441
122 results · Clear filters · Feed
-
High 7.7
Cluster-API proxy overwrites forwarded client identity with its own
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when buil…
-
High 7.8
Servicing Stack Updates Elevation of Privilege Vulnerability
Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
-
High 8.2
Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (…
-
High 8.8
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineerin…
-
High 8.8
Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social enginee…
-
High 8.8
Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially byp…
-
High 7.8
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an…
-
High 8.4
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.4
In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This …
-
High 8.4
In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. Th…
-
High 8.4
In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to …
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) is…
-
High 8.4
In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could …
-
High 8.4
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.4
In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.…
-
High 8.4
In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused de…
-
High 8.4
In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a co…
-
High 8.4
In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused de…
-
High 8.4
In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confu…
-
High 8.6
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…
-
High 8.8
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origi…
-
High 8.8
Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeri…
-
High 8.8
Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social enginee…
-
High 8.8
Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging so…
-
High 8.8
Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
High 8.8
Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social en…
-
High 8.8
Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engin…
-
High 8.8
Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin polic…
-
High 8.8
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system ac…
-
High 7.7
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets R…
-
High 7.7
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses it…
-
High 7.8
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
High 8.1
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around…
-
High 7.5
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rat…
-
High 8.3
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging s…
-
High 8.1
Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
High 8.3
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised th…
-
High 7.8
In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of pri…
-
High 7.8
In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead …