How Xtunnel Can Create Vulnerabilities in Applications

Exploring the security risks associated with Xtunnel, a Russian tunneling service similar to ngrok.

3 min readTechnology

Xtunnel is a Russian tunneling service that claims to be an alternative to ngrok, which is no longer available in the region. While developing a project, I observed some concerning behavior with Xtunnel. For instance, when we set a token as an HTTP-only cookie during the login process, Xtunnel behaves differently than expected. Unlike standard tunneling services that ignore such cookies, Xtunnel caches them and can inject them into relevant requests at will. This means that any method invoked can receive the cookies of the last logged-in user, regardless of who is making the request. Consequently, users can impersonate others without needing to log in, creating significant security risks. This behavior raises questions about the reliability of Xtunnel for secure application development.

Technology