oss-sec mailing list archives
Re: libxml with CGI fix
From: Bob Friesenhahn <bfriesen () simple dallas tx us>
Date: Tue, 13 Sep 2016 14:57:01 -0500 (CDT)
On Tue, 13 Sep 2016, watashiwaher wrote:
Hi, huys! There is a known httpoxy vulnerability ( https://httpoxy.org/ ). There is a problem with CGI usage in all application which use libxml2 library. Attacker can make requests via attacker proxy from target server using this vulnerability. I reported this problem in the 5th august, but developers didn't reply me at all, and I don't know if they want to response.
The referenced web site provides the advice "Do it “at the edge”, where HTTP requests first enter your system.". In this case libxml2 is not the edge. The edge is the parser which accepts the CGI requests.
Adding detection of "REQUEST_METHOD" to libxml2 may reduce the potential menace.
The libxml2 developers should have responded to you but I can see why they would not consider this to be their problem.
If you break libxml2 support for HTTP_PROXY (and/or http_proxy) then the proxy capabilty can't be used outside of CGI applications, which is likely to break existing valid uses.
Bob -- Bob Friesenhahn bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Current thread:
- libxml with CGI fix watashiwaher (Sep 13)
- Re: libxml with CGI fix Bob Friesenhahn (Sep 13)