Researchers discovered that a vulnerability whose existence has been known for 15 years could affect many web applications, allowing malicious actors to launch man-in-the-middle (MitM) attacks.
Dubbed HTTPoxy, the flaw is a namespace conflict issue that affects applications running in Common Gateway Interface (CGI) or CGI-like environments. A website and a logo have been created for HTTPoxy.
CGI is the interface between a web server and applications running on the server. According to CGI specifications, the content of the HTTP Proxy header from a request is assigned to the HTTP_PROXY environment variable. The problem is that HTTP_PROXY is an environment variable that is often used to configure outgoing proxies.
A remote attacker could leverage the vulnerability to specify the proxy server the application uses for outgoing requests, allowing an MitM attack in which they can capture potentially sensitive information or alter data.
Experts said HTTPoxy is easy to exploit – the attacker simply needs to send a specially crafted request that includes a Proxy header to the targeted server. CGI takes the header and turns it into the HTTP_PROXY environment variable. When the web app sees this variable, it configures the client to use it as a proxy, resulting in requests going to the attacker’s server.
The issue has been found to affect Go, PHP, Python, HAProxy, Nginx, Microsoft IIS, Drupal, HHVM, and some Apache products. Mitigation advice and patches have been provided for the affected products. Additionally, companies such as Akamai and CloudFlare have taken steps to protect their customers against potential attacks.
The best mitigation method is to block Proxy request headers before they reach the vulnerable application.
“How you block a Proxy header depends on the specifics of your setup. The earliest convenient place to block the header might be at a web application firewall device, or directly on the webserver running Apache or Nginx,” researchers said.
The following CVE identifiers have been assigned so far: CVE-2016-5385 (PHP), CVE-2016-5386 (Go), CVE-2016-5387 (Apache HTTP Server), CVE-2016-5388 (Apache Tomcat), CVE-2016-1000109 (HHVM) and CVE-2016-1000110 (Python).
HTTPoxy was first discovered and fixed in libwww-perl in 2001, and later that year it was also patched in Curl. While the issue has been mentioned on several occasions over the past years, its impact on other languages and libraries was never analyzed properly until earlier this month when Vend engineer Scott Geary found an instance in the wild.
Related: “Libotr” Library Flaw Exposes Popular IM Apps
Related: Code Execution Flaw Found in Lhasa Decompression Library
Related: Remote Code Execution Flaw Patched in glibc Library