ZimaOS Cloudflare Tunnel Proxy Endpoint Vulnerability Allowing Internal Service Access

A vulnerability in ZimaOS prior to version 1.5.3 allows unauthenticated access to internal localhost services through a proxy endpoint (/v1/sys/proxy) in the web interface. When the product is accessible from the Internet via a Cloudflare Tunnel, this endpoint can be exploited to reach internal-only services and sensitive local endpoints that are meant to be available only on the local network.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal services and endpoints, allowing for information disclosure of sensitive configurations and tokens, unauthorized access to admin APIs, and remote discovery of internal services.

Remediation

Users can upgrade to ZimaOS version 1.5.3 to address this vulnerability.