CyberRota Analysis
AI-GeneratedVersions of guzzlehttp/guzzle prior to 7.14.2 are vulnerable due to improper handling of Proxy-Authorization headers, allowing attackers to capture sensitive proxy credentials via origin server access logs. This vulnerability can be exploited when requests are redirected or misclassified through SOCKS proxies. Developers and organizations utilizing affected versions should prioritize updating to mitigate potential credential exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.