Artica Proxy Loopback Services Remotely Accessible Unauthenticated

Vulnerability

Services bound to the loopback interface on Artica Proxy 4.50 (running on Debian 10 LTS) are accessible through the proxy service itself. In particular, the tailon service (listening on TCP port 7050) runs as the root user and is bound to 127.0.0.1. This bypasses intended isolation of loopback services, allowing external parties to interact with them [1]. The vulnerability corresponds to CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-552 (Files or Directories Accessible to External Parties).

Exploitation

An unauthenticated remote attacker with network access to the Artica Proxy can connect to the proxy service and, through it, reach loopback-bound services. Specifically, the attacker can access the tailon web interface on 127.0.0.1:7050 via the proxy. No authentication is required. Once connected, the attacker can use tailon's functionality to view and download any file on the system, as documented in the tailon security notes [2].

Impact

Successful exploitation allows an attacker to read the contents of any file on the Artica Proxy filesystem, including sensitive configuration files, credentials, logs, and other data. Since tailon runs as root, the attacker gains root-level file read access, leading to complete information disclosure of the system's data [1].

Mitigation

As of the publication date (2024-03-05), no patch or fix has been released by Artica. The vendor has not provided a workaround. It is recommended to isolate the Artica Proxy from untrusted networks or implement strict firewall rules to prevent access to the proxy service from untrusted hosts until a patch becomes available. The tailon service itself should not be exposed, and its configuration should be reviewed to limit file access if possible [1].