Questions tagged [httpoxy]

httpoxy is a vulnerability in CGI applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

How httpoxy works

I have been doing a task on detecting if httpoxy exists on a web server. I did not have any idea about it initially. After reading from a couple of sites, I understood how it works but I'm still ...
0
votes
1answer
41 views

Understanding HTTPoxy

I have been reading about the httpoxy exploit that exists because of CGI. Starting from this document I understood how httpoxy works. My understanding: All the HTTP headers values need to be made ...
1
vote
1answer
170 views

HTTPoxy - What about HTTPS_PROXY when dealing with HTTPoxy vulnerability?

fastcgi_param HTTP_PROXY ""; is the soluntion, but why didn't they also mention HTTPS_PROXY? I have a HTTPS website, not HTTP. Should I also add fastcgi_param HTTPS_PROXY ""; or not? Stop changing ...
12
votes
2answers
1k views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...