What’s this doing that a correctly configured nginx instance doesn’t?

I thought is was generally considered poor form to run an open proxy?

In the web security book that hacker one gives out on registration, this is listed as a vulnerability that pays a bounty