Advisories for Golang/Github.com/Almeidapaulopt/Tsdproxy package

The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For (or X-Real-IP) header from incoming requests before calling r.SetXForwarded(). This allows an authenticated Tailscale user to inject arbitrary X-Forwarded-For values that are forwarded verbatim to backend services. // internal/proxymanager/port.go – Rewrite function Rewrite: func(r *httputil.ProxyRequest) { r.SetURL(pconfig.GetFirstTarget()) r.Out.Host = r.In.Host // Strips tsdproxy identity headers (correct) r.Out.Header.Del(consts.HeaderID) r.Out.Header.Del(consts.HeaderRemoteUser) r.Out.Header.Del(consts.HeaderXForwardedUser) // … other identity headers deleted … // X-Forwarded-For …

A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication token to all proxied backend services. When identityHeaders is enabled (the default), tsdproxy injects x-tsdproxy-auth-token into every upstream HTTP request alongside user identity headers. This token is the same secret used by the management HTTP server to trust forwarded Tailscale identity claims. A backend that receives this token can replay it from localhost to the management port …