CVE-2026-102333 in httpdbg
Summary
by MITRE • 09/29/2026
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in versions of httpdbg prior to 2.2.1 represents a significant security flaw within its web-based interface for analyzing recorded HTTP traffic. The core issue stems from an insufficient validation mechanism regarding URL schemes when rendering captured request URLs as interactive elements. Specifically, the application fails to sanitize or validate the protocol scheme embedded within these URLs before generating clickable hyperlinks in the browser environment. This oversight allows any user whose network traffic is being monitored by httpdbg to inject malicious payloads directly into the analysis interface through standard HTTP requests that contain non-standard URL schemes.
From a technical perspective, this flaw constitutes an instance of Cross-Site Scripting, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. When a user configures httpdbg to capture traffic containing URLs with javascript: URI schemes, the application processes these strings without filtering out the dangerous protocol identifier. Consequently, when the web interface renders these entries as clickable links for ease of access and debugging, it inadvertently creates anchor tags that execute JavaScript code within the context of the httpdbg server's origin upon user interaction. This behavior bypasses standard browser security models such as the Same-Origin Policy because the script execution is triggered by a direct click on an element provided by the trusted application itself, rather than through external injection into a vulnerable page structure in the traditional sense.
The operational impact of this vulnerability is severe for anyone using httpdbg to inspect sensitive network communications. An attacker who controls or can manipulate the traffic being recorded—such as one performing a man-in-the-middle attack on an unencrypted connection or compromising a device generating requests—can craft specific HTTP requests containing javascript: URLs. Once these are captured and displayed in the web interface, any analyst clicking on these links will trigger arbitrary JavaScript execution within the application's domain. This allows the attacker to access sensitive data stored in cookies, local storage, or session tokens associated with httpdbg. Furthermore, it enables the exfiltration of all captured request headers, response bodies, authentication credentials, and other confidential information contained within the recorded sessions, effectively compromising the integrity and confidentiality of the debugging process itself.
This vulnerability aligns closely with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript execution in a browser context. It also reflects weaknesses described in CWE-829: Inclusion of Functionality from Outside Control, as the application incorporates user-supplied input into its functional output without adequate validation. The lack of strict allow-listing for URL schemes means that potentially dangerous protocols like javascript:, data:, or vbscript: are treated identically to safe HTTP or HTTPS links, creating a direct path for client-side code execution.
To mitigate this risk, users must upgrade immediately to httpdbg version 2.2.1 or later, where the developers have implemented proper input validation and output encoding mechanisms. The fix ensures that only valid web protocols such as http and https are permitted in clickable links, while other schemes are either stripped of their protocol identifier or rendered as plain text rather than interactive hyperlinks. Additionally, security practitioners should enforce strict Content Security Policy headers within any custom deployments to restrict script execution sources where possible. For environments requiring the inspection of untrusted traffic, it is advisable to run httpdbg in isolated containers with limited network access and avoid clicking on links from unknown or potentially compromised sessions until the underlying infrastructure has been verified as secure.