Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Old HTTPoxy Flaw Exposes Web Applications to Attacks

Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.

Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.

Dubbed HTTPoxy, the flaw is a namespace conflict issue that affects applications running in Common Gateway Interface (CGI) or CGI-like environments. A website and a logo have been created for HTTPoxy.

CGI is the interface between a web server and applications running on the server. According to CGI specifications, the content of the HTTP Proxy header from a request is assigned to the HTTP_PROXY environment variable. The problem is that HTTP_PROXY is an environment variable that is often used to configure outgoing proxies.HTTPoxy

A remote attacker could leverage the vulnerability to specify the proxy server the application uses for outgoing requests, allowing an MitM attack in which they can capture potentially sensitive information or alter data. 

Experts said HTTPoxy is easy to exploit – the attacker simply needs to send a specially crafted request that includes a Proxy header to the targeted server. CGI takes the header and turns it into the HTTP_PROXY environment variable. When the web app sees this variable, it configures the client to use it as a proxy, resulting in requests going to the attacker’s server.

The issue has been found to affect Go, PHP, Python, HAProxy, Nginx, Microsoft IIS, Drupal, HHVM, and some Apache products. Mitigation advice and patches have been provided for the affected products. Additionally, companies such as Akamai and CloudFlare have taken steps to protect their customers against potential attacks.

The best mitigation method is to block Proxy request headers before they reach the vulnerable application.

“How you block a Proxy header depends on the specifics of your setup. The earliest convenient place to block the header might be at a web application firewall device, or directly on the webserver running Apache or Nginx,” researchers said.

The following CVE identifiers have been assigned so far: CVE-2016-5385 (PHP), CVE-2016-5386 (Go), CVE-2016-5387 (Apache HTTP Server), CVE-2016-5388 (Apache Tomcat), CVE-2016-1000109 (HHVM) and CVE-2016-1000110 (Python).

HTTPoxy was first discovered and fixed in libwww-perl in 2001, and later that year it was also patched in Curl. While the issue has been mentioned on several occasions over the past years, its impact on other languages and libraries was never analyzed properly until earlier this month when Vend engineer Scott Geary found an instance in the wild.

Related: “Libotr” Library Flaw Exposes Popular IM Apps

Related: Code Execution Flaw Found in Lhasa Decompression Library

Related: Remote Code Execution Flaw Patched in glibc Library

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Vulnerabilities

A high-severity format string vulnerability in F5 BIG-IP can be exploited to cause a DoS condition and potentially execute arbitrary code.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.