Progress Telerik Fiddler Classic
Monthly
Privilege escalation in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a local low-privileged attacker replace one of the application's external helper executables with a different, validly signed binary that passes the product's weak publisher-name allow-list check, causing Fiddler to launch attacker-chosen code - including elevated (Administrator) execution for the helper tools that request elevation. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9), requires write access to the installed helper binaries, and is gated on a user launching the affected tool and approving the elevation prompt without noticing the executable name changed; it is not remotely or unauthenticated exploitable, and there is no public exploit identified at time of analysis. The authoritative assessment rates this a moderate, locally-exploitable privilege-escalation flaw rather than a drop-everything priority, with the UI:R requirement and the need for a pre-existing local foothold being the main limits on real-world abuse.
Local privilege abuse in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a low-privileged local attacker plant an attacker-controlled root certificate in the machine's Trusted Root Certification Authorities store by winning a TOCTOU race during Fiddler's one-time HTTPS-decryption certificate trust workflow. The attacker must already have code execution on the host, the legitimate user must initiate the trust operation and approve the UAC elevation prompt, and the substitution of Fiddler's temporary certificate file must land in the narrow window between write and the elevated TrustCert helper's read. No public exploit code has been identified at time of analysis and the flaw is local-only with no remote vector, so this is a conditional, probabilistic privilege-abuse issue rather than an internet-facing emergency.
Front-end request desynchronization in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a locally positioned, low-privileged actor to send a single malformed request through the proxy's forwarding component and have it split into two requests delivered to the origin server, returning an extra smuggled response on the reused client connection. Exploitation is constrained: it requires local access to the Fiddler proxy (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 3.6), depends on the exact condition of a request carrying both Content-Length and Transfer-Encoding headers combined with connection reuse and pipelining behavior, and is limited to shared or multi-user developer environments rather than production edge deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released fix is v6.0.20262.10021.
HTTP request smuggling in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a low-privileged local user sharing the same Fiddler proxy instance to desynchronize requests and poison responses delivered to other users. Fiddler forwards conflicting multiple Content-Length headers verbatim to the origin while framing the body using only the first value, and because the server connection is returned to Fiddler's pipe pool after reading only the first response, an unread smuggled response stays buffered on the socket and is served to the next session that reuses it. Exploitation is authenticated (CVSS vector PR:L), local-only (AV:L), and high complexity (AC:H), requiring a non-RFC-9110-compliant keep-alive origin server; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Privilege escalation in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a local low-privileged attacker replace one of the application's external helper executables with a different, validly signed binary that passes the product's weak publisher-name allow-list check, causing Fiddler to launch attacker-chosen code - including elevated (Administrator) execution for the helper tools that request elevation. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9), requires write access to the installed helper binaries, and is gated on a user launching the affected tool and approving the elevation prompt without noticing the executable name changed; it is not remotely or unauthenticated exploitable, and there is no public exploit identified at time of analysis. The authoritative assessment rates this a moderate, locally-exploitable privilege-escalation flaw rather than a drop-everything priority, with the UI:R requirement and the need for a pre-existing local foothold being the main limits on real-world abuse.
Local privilege abuse in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a low-privileged local attacker plant an attacker-controlled root certificate in the machine's Trusted Root Certification Authorities store by winning a TOCTOU race during Fiddler's one-time HTTPS-decryption certificate trust workflow. The attacker must already have code execution on the host, the legitimate user must initiate the trust operation and approve the UAC elevation prompt, and the substitution of Fiddler's temporary certificate file must land in the narrow window between write and the elevated TrustCert helper's read. No public exploit code has been identified at time of analysis and the flaw is local-only with no remote vector, so this is a conditional, probabilistic privilege-abuse issue rather than an internet-facing emergency.
Front-end request desynchronization in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a locally positioned, low-privileged actor to send a single malformed request through the proxy's forwarding component and have it split into two requests delivered to the origin server, returning an extra smuggled response on the reused client connection. Exploitation is constrained: it requires local access to the Fiddler proxy (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 3.6), depends on the exact condition of a request carrying both Content-Length and Transfer-Encoding headers combined with connection reuse and pipelining behavior, and is limited to shared or multi-user developer environments rather than production edge deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released fix is v6.0.20262.10021.
HTTP request smuggling in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a low-privileged local user sharing the same Fiddler proxy instance to desynchronize requests and poison responses delivered to other users. Fiddler forwards conflicting multiple Content-Length headers verbatim to the origin while framing the body using only the first value, and because the server connection is returned to Fiddler's pipe pool after reading only the first response, an unread smuggled response stays buffered on the socket and is served to the next session that reuses it. Exploitation is authenticated (CVSS vector PR:L), local-only (AV:L), and high complexity (AC:H), requiring a non-RFC-9110-compliant keep-alive origin server; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.