The weakness is very simple but sadly not often warned about in tutorials or guides on how to write a proxy. If the input is HTTP and output is also HTTP and the attacker has significant saying on both ends, a malicious user can shape the output of one proxy to be the input of another proxy, we call this a proxy chain
https://yumechi.jp/en/blog/2024/misskey-hardening/
https://git.usbharu.dev/usbharu/misskey/raw/commit/e967d9ded35cbdf937bbc232e05a5fa0966458a7/src/misc/fetch.ts

#ProxyChain Misuse..  

#repost •acws #acws