Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?

Question

I have a content site https://www.mysite.com

I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled from my site.

For example: https://www.client.com/external-content/content1.html

Would get loaded from: https://www.mysite.com/content1.html

They don't want to do this for fear of exposing their LAN to the Internet. I understand that a reverse proxy server is nothing but a sophisticated redirect and that their main network wouldn't be exposed to, say, directory traversal attacks, mysql injection, etc. Is this correct?

Suppose my site is super vulnerable, is it possible to attack the main server through a reverse proxy connection that doesn't interact in any other way than the one mentioned above?

Is restricting traffic from the reverse proxy IP to only that subdirectory a viable solution?

Thanks in advance!

Answer 1

A reverse proxy is just an efficient tool, but not a magic bullet. When it is properly configured, it can ensure that only legal urls can be reached. But if you let anything pass through it will not protect much.

Security is hard because it is not only a matter of tools: any defect in the configuration of the security tools will open a breach. So the actual security of the solution will depend on the used tool but also on the proficiency of the administrator. Things are like that ...

Answer 2

Yes, one case: if suppose your main site has some config files named connection.*, config.*, password,* or whatever which is accessible to internet via reverse proxy server anyone can go and view whats written inside them until you've explicitly put up a blockade or something on it.