EUVD-2026-53584
GHSA-85pm-3999-r2fw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via API (AV:N), requires only a low-privileged account (PR:L), scope changes to host OS via SSH key injection (S:C), full confidentiality and integrity compromise of host credentials and persistent access.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.
AnalysisAI
Newline injection in boringproxy 0.10.0 and earlier allows authenticated low-privileged users with tunnel-creation permission to write arbitrary entries into the server's SSH authorized_keys file, achieving persistent shell access to the host. By supplying a percent-encoded newline (%0a) in the domain parameter of the tunnel creation API endpoint, an attacker inserts an unrestricted public key, then SSHs directly into the server and reads plaintext credentials - including all user tokens, tunnel private keys, and TLS certificates - from the application's database file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid boringproxy account with tunnel-creation permission - this is a standard low-privileged user role, not an administrative privilege. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with subsequent-system impacts (SC:H/SI:H/SA:H) accurately reflects a severe, network-reachable attack requiring only a low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A registered boringproxy user with standard tunnel-creation permissions sends an HTTP request to the tunnel creation endpoint with the domain parameter set to a value containing a percent-encoded newline followed by an attacker-controlled SSH public key (e.g., domain=example.com%0assh-rsa AAAA...attacker-key). The server decodes the value and writes it verbatim into the SSH authorized_keys file, appending the attacker's key as a new unrestricted entry. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the fix version is not confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems running boringproxy 0.10.0 or earlier and assess network exposure of the tunnel-creation API. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today