Security Experts:

Connect with us

Hi, what are you looking for?



Old HTTPoxy Flaw Exposes Web Applications to Attacks

Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.

Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.

Dubbed HTTPoxy, the flaw is a namespace conflict issue that affects applications running in Common Gateway Interface (CGI) or CGI-like environments. A website and a logo have been created for HTTPoxy.

CGI is the interface between a web server and applications running on the server. According to CGI specifications, the content of the HTTP Proxy header from a request is assigned to the HTTP_PROXY environment variable. The problem is that HTTP_PROXY is an environment variable that is often used to configure outgoing proxies.HTTPoxy

A remote attacker could leverage the vulnerability to specify the proxy server the application uses for outgoing requests, allowing an MitM attack in which they can capture potentially sensitive information or alter data. 

Experts said HTTPoxy is easy to exploit – the attacker simply needs to send a specially crafted request that includes a Proxy header to the targeted server. CGI takes the header and turns it into the HTTP_PROXY environment variable. When the web app sees this variable, it configures the client to use it as a proxy, resulting in requests going to the attacker’s server.

The issue has been found to affect Go, PHP, Python, HAProxy, Nginx, Microsoft IIS, Drupal, HHVM, and some Apache products. Mitigation advice and patches have been provided for the affected products. Additionally, companies such as Akamai and CloudFlare have taken steps to protect their customers against potential attacks.

The best mitigation method is to block Proxy request headers before they reach the vulnerable application.

“How you block a Proxy header depends on the specifics of your setup. The earliest convenient place to block the header might be at a web application firewall device, or directly on the webserver running Apache or Nginx,” researchers said.

The following CVE identifiers have been assigned so far: CVE-2016-5385 (PHP), CVE-2016-5386 (Go), CVE-2016-5387 (Apache HTTP Server), CVE-2016-5388 (Apache Tomcat), CVE-2016-1000109 (HHVM) and CVE-2016-1000110 (Python).

HTTPoxy was first discovered and fixed in libwww-perl in 2001, and later that year it was also patched in Curl. While the issue has been mentioned on several occasions over the past years, its impact on other languages and libraries was never analyzed properly until earlier this month when Vend engineer Scott Geary found an instance in the wild.

Related: “Libotr” Library Flaw Exposes Popular IM Apps

Related: Code Execution Flaw Found in Lhasa Decompression Library

Related: Remote Code Execution Flaw Patched in glibc Library

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet