Milad Fadavvi

The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header (`X-Skipper-Proxy`) to the HTTP request. This is a case of Server-Side Request Forgery (SSRF).

The issue concerns the administration login interface, where an XSS attack can be performed via the `admin/login/user/message/` PATH INFO.