I have been reading about the httpoxy exploit that exists because of CGI. Starting from this document I understood how httpoxy works.
My understanding: All the HTTP headers values need to be made available to the CGI programs and hence these values required for CGI are passed through environment variables.
For example: The path: header gets converted to HTTP_PATH environment variable.
Now comes the HTTP_PROXY. How does HTTP_PROXY environment variable will cause an attack?