# Unauthenticated proxy to local services

Proxy or tunnel endpoints that reach localhost or internal services without a real session check

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-09-17. Updated 2026-10-24._

## How it works
A proxy or tunnel endpoint is meant to relay traffic for an authenticated client. The assumption that breaks is that reaching the endpoint implies the caller was authorized. When the gate is a spoofable header, a magic parameter value, or simply missing on one transport, an outside caller can make the device relay traffic to services that were only ever meant to be reachable from localhost or the internal network. Those services were never hardened for external input, so the proxy becomes their public front door.

## Where it shows up
- Proxy/tunnel handlers (WebSocket, DoH/DoQ/gRPC, IP-in-IP, GRE) that reach localhost or internal backends.
- Authorization decided by `User-Agent`, custom headers, or parameter prefixes (e.g. `bmID=-3389`) instead of a validated session [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md).
- Multiple transports where only the primary listener applies the accept/opcode policy [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-9gm5-9rfh-m6vx.md).
- Tunneling protocols enabled by default and accepting packets from any source [E3](https://bugbountylibrary.com/r/blog%3Akb-cert-org-vuls-id-636397.md).
- Paths built from caller-controlled fields (e.g. a `Target` used to build a rollback path) [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md).

## How to review
For every relay endpoint, trace the request from entry to backend and confirm the exact invariant: no request reaches a localhost or internal service unless a validated session/credential was checked on that same path. Verify the check is not keyed on client-supplied values (headers, parameter prefixes). For each transport, diff the acceptance path against the primary listener and confirm the same policy gate runs before dispatch [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-9gm5-9rfh-m6vx.md). For tunneling protocols, confirm they are off by default or restricted by source/destination [E3](https://bugbountylibrary.com/r/blog%3Akb-cert-org-vuls-id-636397.md). Confirm caller-controlled fields never flow into filesystem or command paths [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md).

## Variants seen
- Header/parameter-gated bypass on a WebSocket proxy to localhost services [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md).
- Alternate transport (DoH/DoQ/gRPC) skipping the opcode policy the UDP/TCP server enforced, forwarding UPDATEs upstream [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-9gm5-9rfh-m6vx.md).
- IP-in-IP decapsulation accepted from any source, routing arbitrary inner traffic [E3](https://bugbountylibrary.com/r/blog%3Akb-cert-org-vuls-id-636397.md).

## Impact and severity
E1 chained the proxy bypass with a path traversal to root RCE on a VPN appliance — critical. E2 let unauthenticated UPDATEs be forwarded as if from the resolver — high. E3 enabled reflective DDoS and ACL bypass — high. Severity rises when the proxy fronts privileged local services or chains into a second flaw.

## Why fixes fail
E2 shows the fix pattern: the policy existed on UDP/TCP but was never applied to newer transports, so the gap persisted until each listener was patched.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-9gm5-9rfh-m6vx.md
- E3: https://bugbountylibrary.com/r/blog%3Akb-cert-org-vuls-id-636397.md