Re: A CGI application vulnerability for PHP, Go, Python and others

[Solar Designer <solar () openwall com>]

On Mon, Jul 18, 2016 at 02:23:41PM -0400, Jan Schaumann wrote:
> Richard Rowe <arch.richard () gmail com> wrote:
>  
> > The consequence is that an attacker can force a proxy of their choice to be
> > used. This proxy receives the full request for anything sent over HTTP
> > using a vulnerable client. It can also act in a malicious way to tie up
> > server resources (a "reverse slowloris").
>
> I know you mentioned it on https://httpoxy.org/, but I think it's worth
> stressing explicitly again:  use of HTTPS for all requests made by the
> application, internal as well as external, defeats this vulnerability
> (provided certificates are actually verified).

Certificates being actually verified doesn't help against use of this
trick for host/port scanning or DoS attacks on third-parties.  What does
fully defeat this vulnerability is if the application or library only
checks a different env var like HTTPS_PROXY for HTTPS connections.  So I
guess whether use of HTTPS fully defeats or partially mitigates the
issue varies by the application or library invoked from a CGI program.

Alexander