Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have been reading about the httpoxy exploit that exists because of CGI. Starting from this document I understood how httpoxy works.
My understanding: All the HTTP headers values need to be made available to the CGI programs and hence these values required for CGI are passed through environment variables.
For example: The path: header gets converted to HTTP_PATH environment variable.
Now comes the HTTP_PROXY. How does HTTP_PROXY environment variable will cause an attack?
Now comes the HTTP_PROXY. How does HTTP_PROXY environment variable will cause an attack?
It does not by itself cause an attack. But, the environment variable HTTP_PROXY is used by many applications to configure the proxy used for HTTP requests. And, since it is an environment variable it will be propagated to child processes too. This means that an external attacker can control the HTTP proxy to be used by internal code, i.e. the CGI script, PHP code itself or applications executed from within this code.
This can lead both to potential information leakage where sensitive data destined for internal applications are sent to the proxy controlled by the attacker. This can also cause the application to trust content fully controlled by the attacker (i.e. returned by the proxy) which then depending on the application can have various effects, for example executing code controlled by the remote attacker.
