[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160718193358.GA4942@openwall.com>
Date: Mon, 18 Jul 2016 22:33:59 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: A CGI application vulnerability for PHP, Go, Python and others
On Mon, Jul 18, 2016 at 02:23:41PM -0400, Jan Schaumann wrote:
> Richard Rowe <arch.richard@...il.com> wrote:
>
> > The consequence is that an attacker can force a proxy of their choice to be
> > used. This proxy receives the full request for anything sent over HTTP
> > using a vulnerable client. It can also act in a malicious way to tie up
> > server resources (a "reverse slowloris").
>
> I know you mentioned it on https://httpoxy.org/, but I think it's worth
> stressing explicitly again: use of HTTPS for all requests made by the
> application, internal as well as external, defeats this vulnerability
> (provided certificates are actually verified).
Certificates being actually verified doesn't help against use of this
trick for host/port scanning or DoS attacks on third-parties. What does
fully defeat this vulnerability is if the application or library only
checks a different env var like HTTPS_PROXY for HTTPS connections. So I
guess whether use of HTTPS fully defeats or partially mitigates the
issue varies by the application or library invoked from a CGI program.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
