CVE-2025-34451

Executive Summary

CVE-2025-34451 is a stack-based buffer overflow vulnerability in the proxy_from_string() function within src/libproxychains.c of the rofl0r/proxychains-ng project, affecting versions up to and including 4.17 and prior to commit cc005b7. The flaw occurs when parsing crafted proxy configuration entries containing overly long username or password fields, allowing an attacker to write beyond the bounds of fixed-size stack buffers. This can lead to memory corruption, denial of service, and potentially arbitrary code execution depending on the execution environment and mitigations. The vulnerability is triggered during the parsing of proxy configuration strings, typically from a configuration file or environment variable. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has not released an official patch, but a fix is available in the project's commit history.

Supply Chain & Package Security

This vulnerability affects the proxychains-ng package, which is commonly distributed via package managers (e.g., apt, yum, brew) and source code repositories. Users who install proxychains-ng from official repositories or build from source are at risk if they use a version <= 4.17. The package is not distributed via NPM, PyPI, Go, or Ruby registries, but it is a critical component in many penetration testing and network analysis toolchains. Supply chain risk is moderate, as the vulnerability is in a widely used utility that may be included in Docker images, CI/CD pipelines, or security appliances.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data, but based on the description, a reasonable assessment is:

• Attack Vector (AV): Local (L) – The attacker needs to provide a crafted configuration file or environment variable.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs to be able to modify the configuration.
• User Interaction (UI): None (N) – No user action required beyond running the tool.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): Low (L) – Potential for memory leak.
• Integrity (I): Low (L) – Potential for memory corruption.
• Availability (A): High (H) – Likely crash or denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H Estimated Base Score: 6.6 (Medium)

Threat Level: Medium. The vulnerability requires local access to modify configuration files, but it can lead to denial of service and potentially code execution in environments without stack canaries or ASLR.

Deep Dive & Mechanics

The vulnerability resides in the proxy_from_string() function in src/libproxychains.c. This function parses a proxy configuration string in the format type host port [user pass]. The username and password fields are copied into fixed-size stack buffers without proper bounds checking. When an attacker provides a username or password longer than the buffer size, a stack-based buffer overflow occurs.

Root Cause: The use of strcpy() or similar unsafe functions to copy user-controlled input into fixed-size stack buffers without length validation.

Trigger: The vulnerability is triggered when proxychains-ng reads a configuration file (e.g., proxychains.conf) or an environment variable (e.g., PROXYCHAINS_CONF) containing a proxy entry with an overly long username or password.

Impact:

• Denial of Service: Overwriting stack data can cause a crash.
• Memory Corruption: Overwriting adjacent stack variables can lead to unpredictable behavior.
• Potential Code Execution: If the attacker can control the overwritten data (e.g., return address), they may achieve arbitrary code execution, though modern mitigations (stack canaries, ASLR) make this harder.

Affected Code Path:

1. User provides a proxy configuration string.
2. proxy_from_string() is called.
3. The function parses the string and extracts username/password.
4. The username/password is copied into a fixed-size stack buffer using an unsafe function.
5. If the input exceeds the buffer size, the stack is corrupted.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.17, prior to commit cc005b7):

// src/libproxychains.c (simplified)
void proxy_from_string(const char *str, struct proxy_entry *entry) {
    char user[64];
    char pass[64];
    // ... parsing logic ...
    sscanf(str, "%*s %*s %*s %s %s", user, pass); // Unsafe: no length limit
    // ... copy to entry ...
}

Patched Code (commit cc005b7):

// src/libproxychains.c (simplified)
void proxy_from_string(const char *str, struct proxy_entry *entry) {
    char user[64];
    char pass[64];
    // ... parsing logic ...
    sscanf(str, "%*s %*s %*s %63s %63s", user, pass); // Safe: limits input length
    // ... copy to entry ...
}

The patch adds length specifiers (%63s) to the sscanf format string, ensuring that no more than 63 characters are read into the 64-byte buffers (leaving room for the null terminator).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running proxychains-ng <= 4.17.
• Ability to modify the configuration file or set environment variables.

Exploitation Steps:

1. Create a malicious configuration file (e.g., evil.conf) with an overly long username:

   socks5 127.0.0.1 1080 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA password
   

2. Run proxychains-ng with the malicious configuration:

   proxychains4 -f evil.conf curl http://example.com
   

3. Observe the crash or potential code execution.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for crashes of proxychains-ng processes.
• Look for configuration files with unusually long strings in proxy entries.
• Use the detection rules provided below.

Mitigation:

• Apply the patch from commit cc005b7 or upgrade to a version > 4.17.
• Restrict write access to proxychains-ng configuration files.
• Use security tools to detect stack-based overflows.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • Configuration files (e.g., proxychains.conf) containing proxy entries with username or password fields longer than 63 characters.
  • Core dumps from proxychains-ng processes.
• Network-based IOCs:
  • Unusual proxy connections originating from systems running vulnerable versions.
• Behavioral IOCs:
  • Unexpected crashes of proxychains-ng.
  • High memory usage or abnormal process termination.

Detection Engineering

YARA Rule

rule CVE_2025_34451_Proxychains_StackOverflow {
    meta:
        description = "Detects stack-based buffer overflow in proxychains-ng configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-34451"
    strings:
        $socks = /socks[45]\s+\S+\s+\d+\s+\S{64,}\s+\S+/ nocase
        $http = /http\s+\S+\s+\d+\s+\S{64,}\s+\S+/ nocase
    condition:
        any of them
}

Sigma Rule

title: Proxychains-ng Stack Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-34451 by providing overly long username/password in proxychains configuration
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/proxychains4'
        CommandLine|contains: '-f'
    condition: selection
falsepositives:
    - Legitimate use of long usernames (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-34451 Proxychains-ng Stack Overflow Attempt"; flow:to_server; content:"|73 6f 63 6b 73|"; nocase; pcre:"/socks[45]\s+\S+\s+\d+\s+\S{64,}\s+\S+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit cc005b7 by rebuilding proxychains-ng from source:

   git clone https://github.com/rofl0r/proxychains-ng.git
   cd proxychains-ng
   git checkout cc005b7
   make && sudo make install
   

2. If rebuilding is not possible, restrict write access to configuration files and environment variables.
3. Monitor for crashes or unusual behavior.

Long-term Mitigation:

• Upgrade to a version > 4.17 once an official release is available.
• Implement input validation in any custom scripts that generate proxy configurations.
• Use stack canaries and ASLR in the build environment.

Workarounds:

• Avoid using username/password in proxy configurations if not necessary.
• Use a configuration management tool to enforce secure configurations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert