Texonet has reported a vulnerability in BadBlue, allowing malicious people to relay connections.

The problem is that there is an option called "PassThru", which can be used to force the BadBlue server to act as a proxy. Malicious people can exploit this to access both internal and external resources.

Example:
http://[victim]/ext.dll?mfcisapicommand=PassThru&url=[ip:port]/[request]

This vulnerability reportedly affects BadBlue Personal Edition 2.5 and prior. The Enterprise Edition may also be affected.

Solution
Use another product.

Provided and/or discovered by
Texonet

Original Advisory
http://www.idefense.com/application/poi/display?id=123&type=vulnerabilities

Deep Links
Links available in Customer Area