An authenticated CRLF injection flaw in boringproxy allows low-privileged users to inject malicious SSH keys, resulting in full system compromise and credential exfiltration.

The application improperly neutralizes CRLF sequences in the domain parameter during tunnel creation, allowing an authenticated user with tunnel-creation privileges to inject arbitrary lines into the server account's authorized_keys file. This enables the attacker to add their own public key for persistent shell access and read sensitive credentials from the database.

This vulnerability allows a low-privileged user to escalate their access to full shell control of the server. With a CVSS score of 9.9, the potential for data exfiltration, including TLS certificates and tunnel private keys, presents a severe risk to the confidentiality and integrity of all proxied traffic.

Immediate Action: Update boringproxy to the latest version, which includes proper input sanitization to prevent CRLF injection.

Proactive Monitoring: Audit the server's authorized_keys file for unauthorized public key entries and monitor user account activity for unusual tunnel creation patterns.

Compensating Controls: Implement strict network-level controls to limit access to the tunnel creation endpoint to only authorized and trusted users.

Public Exploit Available: Yes, a public proof-of-concept exists via the reference repository.

Organizations utilizing boringproxy must treat this as a high-priority update. The ability for a low-privileged user to gain persistent shell access necessitates an immediate patch and a thorough audit of existing authorized_keys files for indicators of compromise.