Overview
The vulnerability CVE-2025-54581 is a critical flaw affecting vProxy Servers version 2.3.3 and below. It allows an attacker to cause a server crash resulting in a denial-of-service (DoS) attack. This exploits the untrusted data extraction from a user-controlled HTTP Proxy-Authorization header and can potentially lead to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-54581
Severity: High (7.5/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: A successful exploit of this vulnerability could cause a denial-of-service attack, potentially compromising the system and causing data leakage.
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
vProxy | 2.3.3 and below
How the Exploit Works
The exploit works by an attacker manipulating the HTTP Proxy-Authorization header. This header is user-controlled and untrusted data is extracted from it. The manipulated data is passed to Extension::try_from and eventually flows into parse_ttl_extension, where it is parsed as a TTL (Time-To-Live) value. If the attacker supplies a TTL of zero (e.g. by setting the username as ‘configuredUser-ttl-0’), a division by zero error occurs, leading to a server crash and a subsequent denial-of-service attack.
Conceptual Example Code
Here is a conceptual example of how this vulnerability might be exploited. This could be done through an HTTP request as shown below:
GET / HTTP/1.1
Host: target.vproxy.com
Proxy-Authorization: Basic Y29uZmlndXJlZFVzZXItdHRsLTA=The Proxy-Authorization header above is a Base64 encoded string of ‘configuredUser-ttl-0’. The server parses this as a TTL value of zero, leading to a division by zero crash, hence causing a denial-of-service.
For mitigation, it is advised to apply the vendor patch or use WAF/IDS as temporary mitigation. The vulnerability has been fixed in vProxy server version 2.4.0.