mitmproxy mitmweb Internal API Access Vulnerability Leading to Potential Remote Code Execution

A vulnerability in mitmweb versions through 11.1.1 allows a malicious client to use the proxy server to access mitmweb's internal API, which is normally restricted to localhost. This access could potentially be exploited to execute remote code. The issue does not affect the mitmproxy or mitmdump tools. The vulnerability arises because the proxy server, bound to all interfaces by default, can be used to reach the internal API, creating a server-side request forgery (SSRF) scenario. An attacker would need to be on the same local network, as connections from publicly-routable IP addresses are blocked by default.

Impact

Exploitation of this vulnerability could lead to unauthorized access to mitmweb's internal API and potentially allow for remote code execution on the server.

Remediation

Users are advised to upgrade to mitmproxy version 11.1.2 or later.