GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CNVD-2016-04948

Vulnerability from cnvd - Published: 2016-07-19
VLAI
Title
Apache HTTP Server存在httpoxy远程代理感染漏洞
Description
Apache HTTP Server是美国阿帕奇（Apache）软件基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 httpoxy是一组影响应用程序代码在CGI环境运行的漏洞。该漏洞主要存在于多个Web服务器、Web框架和编程语言中。可对HTTP头部的Proxy字段名变换为“HTTP_PROXY”，Value值不变，进而传递给对应的CGI执行；若CGI或脚本中使用对外请求的组件依赖的是“HTTP_PROXY”环境变量，就可能被污染。未经身份验证的远程攻击者利用漏洞可发起中间人攻击，或在服务器上启动任意主机的连接。 Apache HTTP Server存在httpoxy远程代理感染漏洞，该漏洞源于程序未能解决RFC 3875模式下的命名空间冲突。程序未能正确处理来自HTTP_PROXY环境变量中不可信客户端数据应用程序。允许远程攻击者通过精心设计的HTTP请求代理头重定向应用程序的出站HTTP流量到任意一个代理服务器。
Severity
中
Patch Name
Apache HTTP Server存在httpoxy远程代理感染漏洞的补丁
Patch Description
Apache HTTP Server是美国阿帕奇（Apache）软件基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 httpoxy是一组影响应用程序代码在CGI环境运行的漏洞。该漏洞主要存在于多个Web服务器、Web框架和编程语言中。可对HTTP头部的Proxy字段名变换为“HTTP_PROXY”，Value值不变，进而传递给对应的CGI执行；若CGI或脚本中使用对外请求的组件依赖的是“HTTP_PROXY”环境变量，就可能被污染。未经身份验证的远程攻击者利用漏洞可发起中间人攻击，或在服务器上启动任意主机的连接。 Apache HTTP Server存在httpoxy远程代理感染漏洞，该漏洞源于程序未能解决RFC 3875模式下的命名空间冲突。程序未能正确处理来自HTTP_PROXY环境变量中不可信客户端数据应用程序。允许远程攻击者通过精心设计的HTTP请求代理头重定向应用程序的出站HTTP流量到任意一个代理服务器。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商提供了修复方案，请及时更新： http://www.apache.org/security/asf-httpoxy-response.txt

Reference
https://httpoxy.org/ https://www.kb.cert.org/vuls/id/797896 https://www.apache.org/security/asf-httpoxy-response.txt https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5387
Impacted products
Name
['Apache HTTP Server', 'Apache HTTP Server <=2.4.23']
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "91816"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5387"
    }
  },
  "description": "Apache HTTP Server\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7f51\u9875\u670d\u52a1\u5668\u3002\u8be5\u670d\u52a1\u5668\u5177\u6709\u5feb\u901f\u3001\u53ef\u9760\u4e14\u53ef\u901a\u8fc7\u7b80\u5355\u7684API\u8fdb\u884c\u6269\u5145\u7684\u7279\u70b9\u3002 \r\n\r\nhttpoxy\u662f\u4e00\u7ec4\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u5728CGI\u73af\u5883\u8fd0\u884c\u7684\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4e3b\u8981\u5b58\u5728\u4e8e\u591a\u4e2aWeb\u670d\u52a1\u5668\u3001Web\u6846\u67b6\u548c\u7f16\u7a0b\u8bed\u8a00\u4e2d\u3002\u53ef\u5bf9HTTP\u5934\u90e8\u7684Proxy\u5b57\u6bb5\u540d\u53d8\u6362\u4e3a\u201cHTTP_PROXY\u201d\uff0cValue\u503c\u4e0d\u53d8\uff0c\u8fdb\u800c\u4f20\u9012\u7ed9\u5bf9\u5e94\u7684CGI\u6267\u884c\uff1b\u82e5CGI\u6216\u811a\u672c\u4e2d\u4f7f\u7528\u5bf9\u5916\u8bf7\u6c42\u7684\u7ec4\u4ef6\u4f9d\u8d56\u7684\u662f\u201cHTTP_PROXY\u201d\u73af\u5883\u53d8\u91cf\uff0c\u5c31\u53ef\u80fd\u88ab\u6c61\u67d3\u3002\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u53d1\u8d77\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u6216\u5728\u670d\u52a1\u5668\u4e0a\u542f\u52a8\u4efb\u610f\u4e3b\u673a\u7684\u8fde\u63a5\u3002 \r\n\r\nApache HTTP Server\u5b58\u5728httpoxy\u8fdc\u7a0b\u4ee3\u7406\u611f\u67d3\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u89e3\u51b3RFC 3875\u6a21\u5f0f\u4e0b\u7684\u547d\u540d\u7a7a\u95f4\u51b2\u7a81\u3002\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\u6765\u81eaHTTP_PROXY\u73af\u5883\u53d8\u91cf\u4e2d\u4e0d\u53ef\u4fe1\u5ba2\u6237\u7aef\u6570\u636e\u5e94\u7528\u7a0b\u5e8f\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u901a\u8fc7\u7cbe\u5fc3\u8bbe\u8ba1\u7684HTTP\u8bf7\u6c42\u4ee3\u7406\u5934\u91cd\u5b9a\u5411\u5e94\u7528\u7a0b\u5e8f\u7684\u51fa\u7ad9HTTP\u6d41\u91cf\u5230\u4efb\u610f\u4e00\u4e2a\u4ee3\u7406\u670d\u52a1\u5668\u3002",
  "discovererName": "Scott Geary",
  "formalWay": "\u5382\u5546\u63d0\u4f9b\u4e86\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttp://www.apache.org/security/asf-httpoxy-response.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-04948",
  "openTime": "2016-07-19",
  "patchDescription": "Apache HTTP Server\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7f51\u9875\u670d\u52a1\u5668\u3002\u8be5\u670d\u52a1\u5668\u5177\u6709\u5feb\u901f\u3001\u53ef\u9760\u4e14\u53ef\u901a\u8fc7\u7b80\u5355\u7684API\u8fdb\u884c\u6269\u5145\u7684\u7279\u70b9\u3002\r\nhttpoxy\u662f\u4e00\u7ec4\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u5728CGI\u73af\u5883\u8fd0\u884c\u7684\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4e3b\u8981\u5b58\u5728\u4e8e\u591a\u4e2aWeb\u670d\u52a1\u5668\u3001Web\u6846\u67b6\u548c\u7f16\u7a0b\u8bed\u8a00\u4e2d\u3002\u53ef\u5bf9HTTP\u5934\u90e8\u7684Proxy\u5b57\u6bb5\u540d\u53d8\u6362\u4e3a\u201cHTTP_PROXY\u201d\uff0cValue\u503c\u4e0d\u53d8\uff0c\u8fdb\u800c\u4f20\u9012\u7ed9\u5bf9\u5e94\u7684CGI\u6267\u884c\uff1b\u82e5CGI\u6216\u811a\u672c\u4e2d\u4f7f\u7528\u5bf9\u5916\u8bf7\u6c42\u7684\u7ec4\u4ef6\u4f9d\u8d56\u7684\u662f\u201cHTTP_PROXY\u201d\u73af\u5883\u53d8\u91cf\uff0c\u5c31\u53ef\u80fd\u88ab\u6c61\u67d3\u3002\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u53d1\u8d77\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u6216\u5728\u670d\u52a1\u5668\u4e0a\u542f\u52a8\u4efb\u610f\u4e3b\u673a\u7684\u8fde\u63a5\u3002\r\nApache HTTP Server\u5b58\u5728httpoxy\u8fdc\u7a0b\u4ee3\u7406\u611f\u67d3\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u89e3\u51b3RFC 3875\u6a21\u5f0f\u4e0b\u7684\u547d\u540d\u7a7a\u95f4\u51b2\u7a81\u3002\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\u6765\u81eaHTTP_PROXY\u73af\u5883\u53d8\u91cf\u4e2d\u4e0d\u53ef\u4fe1\u5ba2\u6237\u7aef\u6570\u636e\u5e94\u7528\u7a0b\u5e8f\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u901a\u8fc7\u7cbe\u5fc3\u8bbe\u8ba1\u7684HTTP\u8bf7\u6c42\u4ee3\u7406\u5934\u91cd\u5b9a\u5411\u5e94\u7528\u7a0b\u5e8f\u7684\u51fa\u7ad9HTTP\u6d41\u91cf\u5230\u4efb\u610f\u4e00\u4e2a\u4ee3\u7406\u670d\u52a1\u5668\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache HTTP Server\u5b58\u5728httpoxy\u8fdc\u7a0b\u4ee3\u7406\u611f\u67d3\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache HTTP Server",
      "Apache HTTP Server \u003c=2.4.23"
    ]
  },
  "referenceLink": "https://httpoxy.org/\r\nhttps://www.kb.cert.org/vuls/id/797896\r\nhttps://www.apache.org/security/asf-httpoxy-response.txt\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5387",
  "serverity": "\u4e2d",
  "submitTime": "2016-07-19",
  "title": "Apache HTTP Server\u5b58\u5728httpoxy\u8fdc\u7a0b\u4ee3\u7406\u611f\u67d3\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.