Imgproxy Unauthenticated Access Scanner

Imgproxy is a high-performance image processing server used by developers and organizations to resize, crop, and transform images on the fly. It is commonly deployed in web applications that require real-time image manipulation, reducing server load by offloading processing tasks. Built by Evil Martians, Imgproxy supports various image formats and transformations, making it a popular choice for modern web development.

Unauthenticated access in Imgproxy occurs when the server is not configured to require valid credentials for API requests. This vulnerability typically arises from missing or misconfigured authentication settings, such as the IMGPROXY_SECRET environment variable. Without proper authentication, any user can send requests to the server.

The vulnerability affects the main Imgproxy endpoint, which processes image URLs and transformation parameters. An attacker can send crafted requests to this endpoint without any authentication, potentially accessing or manipulating image processing functions that should be restricted to authorized users.

If exploited, unauthenticated access can lead to unauthorized image processing, data exposure, or server resource abuse. Attackers could use the server to process arbitrary images, potentially consuming bandwidth and CPU resources, or access sensitive images if the server is configured to fetch from internal networks.