CVE-2016-5385: High severity php vulnerability
Dominic Scheirlinck of VendHQ reports:
Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTPPROXY” environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service.
The PHP web framework contains will automatically populate the HTTPPROXY environmental variable with a user supplied "Proxy" header.
Other sources
Drupal Core - Highly Critical - Injection - SA-CORE-2016-003
Fixed bug (HTTPPROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
— PHP
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTPPROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5385?
CVE-2016-5385 is classified as a medium severity vulnerability.
How do I fix CVE-2016-5385?
To fix CVE-2016-5385, update the affected packages to their latest versions as specified in the vulnerability report.
Which software is affected by CVE-2016-5385?
CVE-2016-5385 affects various packages including PHP, Drupal, Guzzle, and many others.
What type of vulnerability is CVE-2016-5385?
CVE-2016-5385 is a vulnerability related to improper handling of the Proxy request header.
Is CVE-2016-5385 being actively exploited?
There have been no public reports indicating that CVE-2016-5385 is currently being actively exploited.