Comment by pedrovhb

I imagine it wouldn't necessarily require their opening of remote connections, just a misconfigured reverse proxy.