REDHAT-BUG-2531343: Medium severity BusyBox BusyBox httpd vulnerability
A vulnerability was found in the BusyBox httpd reverse proxy feature (networking/httpd.c). The P: reverse-proxy dispatch logic executes before Basic Authentication checks are performed. Because the relay function terminates via cgiioloopandexit(), which is marked NORETURN, any authentication rule (A:) configured on a proxied URL prefix is effectively dead code. Requests matching a proxy rule are forwarded to the backend server without any credential validation.
Additionally, the byte-transparent nature of the relay allows HTTP request pipelining. An attacker can craft pipelined HTTP requests that reach arbitrary backend paths and methods through the proxy, including administrative endpoints. Any HTTP method, including DELETE, PUT, and POST, is forwarded without credential checks.
This flaw enables unauthenticated remote attackers to access all backend resources behind the proxy, bypass intended access controls, and invoke arbitrary HTTP methods against backend services.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
BusyBox httpd deployments using its reverse-proxy feature are exposed when they rely on Basic Authentication rules configured for proxied URL prefixes. Backend resources reachable through matching proxy rules may be accessible without the intended credential check.
Does an attacker need valid Basic Authentication credentials?
No. Requests matching a reverse-proxy rule are forwarded before Basic Authentication checks are performed, so an unauthenticated remote attacker can reach the backend through the proxy.
What impact should be considered during triage?
The proxy can forward arbitrary HTTP methods, including DELETE, PUT, and POST, to backend services without credential validation. HTTP request pipelining can also be used to reach arbitrary backend paths and administrative endpoints through the proxy.
How can I identify configurations at risk?
Review BusyBox httpd configuration for reverse-proxy rules and determine whether Basic Authentication rules are intended to protect the same proxied URL prefixes. Any backend resource reachable through those proxy rules should be treated as potentially accessible without authentication.