HTTPoxy Can Enable Man-in-the-Middle Attacks

A widely known, 15-year-old scripting vulnerability is causing unexpected problems for many Linux distributions and programming languages, according to Threatpost. The problem exposes many PHP and CGI web apps to man-in-the-middle attacks.

Serverside web applications that run in older Common Gateway Interface (CGI) or CGI-like environments, such as some FastCGI configurations, will be affected by the new discovery. It also affects programming languages such as PHP, Python and Go.

HTTPoxy Can Lead to Man-in-the-Middle Attacks

The vulnerability is rated as medium and can be exploited easily by miscreants with simple skills.

“This is a very serious flaw if you’re one of the few still reliant on CGI and PHP for generating web pages,” Dominic Scheirlinck, principal engineer of VendHQ, told Threatpost. He is from the team at VendHG that gave the vulnerability the moniker.

Scheirlinck explained that the problem arose from a simple namespace conflict tied to HTTP proxy headers that unsafely trust the HTTP_PROXY environment variable when generating forward requests. This allows an attacker to remotely configure the HTTP_PROXY environment by submitting a malicious HTTP header.

The flaw would open up the affected server to a remotely exploitable vulnerability. For example, an attacker could launch a man-in-the-middle attack and redirect traffic to an arbitrary host.

It could also allow a cybercriminal to intercept traffic and eavesdrop on communications. An old-fashioned denial-of-service attack is also possible.

2001: An HTTPoxy Odyssey

Scheirlinck discussed the deeper origins of the vulnerability. The root cause of the problem, he thinks, is a Perl flaw discovered by Randal L. Schwartz in 2001. Schwartz quickly fixed the vulnerability in Perl libraries.

But since then, other variations of the bug have cropped up, and vendors are not always able to draw connections between the current issues and the original vulnerability.

Servers do not usually depend on a CGI environment to generate webpages like they did in the past. That will help control the proliferation of attacks based on the vulnerability.

The CVEs that address all components of this problem across languages include PHP (CVE-2016-5385), Go (CVE-2016-5386), Apache HTTP Server (CVE-2016-5387), Apache Tomcat (CVE-2016-5388), HHVM (CVE-2016-1000109) and Python (CVE-2016-1000110).

Larry Loeb

Principal, PBC Enterprises

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything.But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists in…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

HTTPoxy Can Lead to Man-in-the-Middle Attacks

2001: An HTTPoxy Odyssey

More from

What cybersecurity pros can learn from first responders

Unified endpoint management for purpose-based devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

Operationalize cyber risk quantification for smart security

Topic updates