Questions tagged [httpoxy]

httpoxy is a vulnerability in CGI applications.

Filter by
Sorted by
Tagged with
0 votes
1 answer

How httpoxy works

I have been doing a task on detecting if httpoxy exists on a web server. I did not have any idea about it initially. After reading from a couple of sites, I understood how it works but I'm still ...
KESHAV K's user avatar
0 votes
1 answer

Understanding HTTPoxy

I have been reading about the httpoxy exploit that exists because of CGI. Starting from this document I understood how httpoxy works. My understanding: All the HTTP headers values need to be made ...
KESHAV K's user avatar
1 vote
1 answer

HTTPoxy - What about HTTPS_PROXY when dealing with HTTPoxy vulnerability?

fastcgi_param HTTP_PROXY ""; is the soluntion, but why didn't they also mention HTTPS_PROXY? I have a HTTPS website, not HTTP. Should I also add fastcgi_param HTTPS_PROXY ""; or not? Stop changing ...
TomCat's user avatar
  • 21
12 votes
2 answers

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
boleslaw.smialy's user avatar