A widely known, 15-year-old scripting vulnerability is causing unexpected problems for many Linux distributions and programming languages, according to Threatpost. The problem exposes many PHP and CGI web apps to man-in-the-middle attacks.

Serverside web applications that run in older Common Gateway Interface (CGI) or CGI-like environments, such as some FastCGI configurations, will be affected by the new discovery. It also affects programming languages such as PHP, Python and Go.

HTTPoxy Can Lead to Man-in-the-Middle Attacks

The vulnerability is rated as medium and can be exploited easily by miscreants with simple skills.

“This is a very serious flaw if you’re one of the few still reliant on CGI and PHP for generating web pages,” Dominic Scheirlinck, principal engineer of VendHQ, told Threatpost. He is from the team at VendHG that gave the vulnerability the moniker.

Scheirlinck explained that the problem arose from a simple namespace conflict tied to HTTP proxy headers that unsafely trust the HTTP_PROXY environment variable when generating forward requests. This allows an attacker to remotely configure the HTTP_PROXY environment by submitting a malicious HTTP header.

The flaw would open up the affected server to a remotely exploitable vulnerability. For example, an attacker could launch a man-in-the-middle attack and redirect traffic to an arbitrary host.

It could also allow a cybercriminal to intercept traffic and eavesdrop on communications. An old-fashioned denial-of-service attack is also possible.

2001: An HTTPoxy Odyssey

Scheirlinck discussed the deeper origins of the vulnerability. The root cause of the problem, he thinks, is a Perl flaw discovered by Randal L. Schwartz in 2001. Schwartz quickly fixed the vulnerability in Perl libraries.

But since then, other variations of the bug have cropped up, and vendors are not always able to draw connections between the current issues and the original vulnerability.

Servers do not usually depend on a CGI environment to generate webpages like they did in the past. That will help control the proliferation of attacks based on the vulnerability.

The CVEs that address all components of this problem across languages include PHP (CVE-2016-5385), Go (CVE-2016-5386), Apache HTTP Server (CVE-2016-5387), Apache Tomcat (CVE-2016-5388), HHVM (CVE-2016-1000109) and Python (CVE-2016-1000110).