PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 · Jul 19, 2016

Dedicated discussion thread for PHP-FPM Security Update HTTPoxy Vulnerability CVE-2016-5385 | Centmin Mod Community.

Updating to fix HTTPoxy

If you don't use centmin.sh menu option 23 submenu option 2 to update your centmin mod code, you can just use git command line if you already have Centmin Mod git environment setup via centmin.sh menu option 23 submenu option 1. Using these commands in SSH session are equivalent to using centmin.sh menu option 23 submenu option 2
Code (Text):
cd /usr/local/src/centminmod
git stash
git pull
./centmin.sh
Checking if PHP-FPM is secure
Revenge said: ↑
Quick way to check if your site is vulnerably or not:
Create a php file with this:

PHP:

<?php if (isset($_SERVER['HTTP_PROXY']) && $_SERVER['HTTP_PROXY'] == 'vulnerable') { echo 'Vulnerable!'; }

Now run this on your server:
Code (Text):
curl --header "Proxy: vulnerable" http://example.com/httpoxy.php
If you don't receive nothing, your are good. If you receive "Vulnerable!", you are not good.
Click to expand...
Update PHP Too

Note PHP has also been updated with native HTTPoxy fixes in

PHP 5.5.38 PHP - PHP 5.5.38 is released | Centmin Mod Community

PHP 5.6.24 PHP - PHP 5.6.24 is available | Centmin Mod Community

PHP 7.0.9 PHP - PHP 7.0.9 is available | Centmin Mod Community

centmin.sh menu option 5 can be used to update your PHP versions by specifying the version number you want when prompted i.e. = 5.6.24

More info at httpoxy

The CERT vulnerability note - VU#797896

Red Hat advisory

The Apache Software Foundation advisory

Microsoft advisory KB3179800

NGINX blog post

Drupal advisory

Fastly advisory

Cloudflare blog post

Akamai blog post

LiteSpeed blog post

This post describes the vulnerability and explains how to use NGINX or NGINX Plus to defeat attempts to exploit it on your servers.

The vulnerability exists because of a namespace clash. A CGI or FastCGI-like interface sets environment variables based on HTTP request parameters, and these can override internal variables that are used to configure the application.

Currently, the only known exploit of this vulnerability is to web applications running in CGI and CGI-like environments that use certain HTTP client libraries to make HTTP requests to other services. In this case, an attacker can potentially redirect internal requests generated by the application to a server of their choosing, and thus capture any secret data contained in the requests,

Click to expand...

eva2000 · Jul 19, 2016

also if you have manually configured nginx proxying yourself (not by default in centmin mod) be sure to set in your nginx vhost
Code (Text):
proxy_set_header Proxy "";

negative · Jul 19, 2016

I have a problem about that fixing.
PHP-FPM - After fixing the latest php-fpm bug, website breaks | Centmin Mod Community

Revenge · Jul 19, 2016

Nginx have updated their example resources to include this mitigation:
PHP FastCGI Example | NGINX

Revenge · Jul 19, 2016

We also need to add that parameter to every php pool, or only in nginx is enough?

Revenge · Jul 19, 2016

Quick way to check if your site is vulnerably or not:
Create a php file with this:

PHP:

<?php if (isset($_SERVER['HTTP_PROXY']) && $_SERVER['HTTP_PROXY'] == 'vulnerable') { echo 'Vulnerable!'; }

Now run this on your server:
Code:
curl --header "Proxy: vulnerable" http://example.com/httpoxy.php
If you don't receive nothing, your are good. If you receive "Vulnerable!", you are not good.

negative · Jul 19, 2016

I didn't fixed but i receive nothing with your test ? So is it normal? @Revenge

Revenge · Jul 19, 2016

negative said: ↑

I didn't fixed but i receive nothing with your test ? So is it normal? @Revenge
Click to expand...

I got that check from reddit and it worked for me. Before i added the mitigation, it showed my site as vulnerably.

eva2000 · Jul 20, 2016

Revenge said: ↑

Nginx have updated their example resources to include this mitigation:
PHP FastCGI Example | NGINX
Click to expand...

cheers the example is pretty much what centmin mod auto updated fix does at PHP-FPM Security Update HTTPoxy Vulnerability CVE-2016-5385 | Centmin Mod Community in terms of setting up
Code (Text):
fastcgi_param  HTTP_PROXY         "";
in all centmin mod php include files just the regex match is different so can't use the test php file. I'll update centmin mod to fix that

Revenge said: ↑

If you don't receive nothing, your are good. If you receive "Vulnerable!", you are not good.
Click to expand...

cheers !

negative said: ↑

I didn't fixed but i receive nothing with your test ? So is it normal? @Revenge
Click to expand...

2 separate things, if you updated to centmin mod latest branch and re-ran centmin.sh the HTTPoxy fix would of deployed as per Beta Branch - security fix for php-fpm for http proxy header CVE-2016-5385 | Centmin Mod Community the other separate item is the php include file parameters.

The separate item for testing the test php file outlined at PHP FastCGI Example | NGINX is to manually update your php.conf include files with changes outlined at update php.conf include file parameters · centminmod/centminmod@19d5f91 · GitHub Working on auto replacements for them but not done yet as regex replacements aren't my strong suit

edit: fixed the php.conf include files syntax so you can use the example test php file as well Beta Branch - add fixphpfpm_includes function to fix php.conf syntax | Centmin Mod Community

eva2000 · Jul 20, 2016

Dominic's medium blog has more coverage of HTTPoxy vulnerability Dominic Scheirlinck — Profile — Medium

What is httpoxy? — WE BUILD VEND — Medium

How “The Internet’s Biggest Blind Spot” lead to a 15 year old security vulnerability — WE BUILD VEND — Medium

Mitigating factors — the good news
There are a few things that make httpoxy much less of an issue than it might otherwise be:

A lot of APIs require an encrypted (SSL/TLS/HTTPS) connection these days, and those requests cannot be attacked in the same way — httpoxy only affects unencrypted requests made by the server

httpoxy is very easy to mitigate against; you just stop the Proxy header from reaching the app altogether, and the problem is solved.

CGI is much less widely deployed than it used to be; we have faster and better ways to serve web applications these days, and those tend to be used instead.

So, httpoxy is embarrassingly simple to exploit, and you can do so remotely, and it can have fairly bad consequences. But, it’s also very easy to fix. We expect anyone affected should be able to fix their web application within a very short timeframe.

What do I do?
If you’re a web application developer, or you look after a deployed site, you should check if you’re affected at httpoxy.org, and apply the fast, easy mitigation as soon as you can.

But if you’re an end-user of a web application, or just reading along for fun, then there’s not really anything for you to do other than enjoy the schadenfreude.
Click to expand...

eva2000 · Jul 20, 2016

HTTPoxy - CGI "HTTP_PROXY" variable name clash - Red Hat Customer Portal

Red Hat Product Security has rated this update as having a security impact of Important .

To diagnose this vulnerability in your environment, see the Resolve tab.

Impacted Products

Red Hat Enterprise Linux 7.x

Red Hat Enterprise Application Platform 6.x

Red Hat Enterprise Web Server 2.x

Red Hat JBoss Web Server 3.x

Red Hat Software Collections

Attack description and impact
The Attack
The attack is fairly straight-forward. An attacker sends a specially crafted HTTP request to a vulnerable CGI script. The request contains a "Proxy" header with the hostname or IP address and port of an attacker-controlled proxy as its value. The HTTP server receives the request and, as part of the usual processing, converts the "Proxy" header and its value into the "HTTP_PROXY" meta-data variable before continuing by calling the CGI script. The CGI script then reads the HTTP_PROXY variable, but confuses it with the "system" variable used to communicate the settings for the outgoing HTTP proxy and configures itself to use the specified proxy. If the CGI script performs HTTP requests, those requests are then sent through the attacker-controlled proxy, allowing the attacker to "Man-in-the-Middle" all parts of the HTTP traffic.

The Impact and Criticality
CGI scripts are only susceptible to this vulnerability if they misinterpret the HTTP_PROXY variable AND send HTTP (or in some cases HTTPS) requests. The number of scripts doing both of these will be a smaller subset of general CGI scripts.

It is difficult to state global impact and criticality, because this depends on how CGI script behaves. A particularly bad scenario is a CGI script that performs sensitive tasks (for example, authenticating using a REST-style API). In this case, an attacker could re-direct all parts of the HTTP traffic between the CGI script and the (REST-style) HTTP server through the attacker-controlled proxy. This could lead to the disclosure of sensitive information contained within both request and response sent between the CGI script and HTTP server.

Additionally, the attacker could manipulate the request and response content. If the CGI script sends requests to an internal server that cannot be reached from the outside internet, the attacker's proxy could not communicate with the internal server and the attacker could not intercept the internal server's responses. However, the attacker could still intercept the CGI script's request and send back a fake response.
Click to expand...

Mitigation
For mitigation details, review the Knowledgebase article matching your impacted server:

HTTPoxy - Is my JBoss/tomcat affected?

HTTPoxy - Is my Apache mod_cgi affected?

HTTPoxy - Is my nginx affected?

HTTPoxy - Is my Apache mod_fcgid affected?

HTTPoxy - Is my PHP application affected?

HTTPoxy - Is my Go application affected?

Click to expand...

eva2000 · Jul 20, 2016

seems there's an online tester tool for HTTPoxy HTTPOXY Vulnerability Checking Tool

no idea how accurate it is though

eva2000 · Jul 20, 2016

FYI, some folks using Centmin Mod in their nginx vhosts have disabled the default php.conf include file in favour of using their own php extension location match - so if you have done such, you need to manually at the fix to your php extension location match context

i.e.
Code (Text):
    location ~ \.php$ {
        . . .
        fastcgi_param HTTP_PROXY "";
        . . .
    }
however, for most Centmin Mod folks, if they use default php.conf include file instead then latest 123.08stable and 123.09beta01 updated code auto patch fixes all the include files with the relevant setting. It's reason a php.conf include file is used when nginx vhosts are auto generated via centmin.sh menu option 2 or 22 for easier mass updates in future
Code (Text):
include /usr/local/nginx/conf/php.conf;

eva2000 · Jul 20, 2016

FYI ownCloud is also vulnerable due to 3rd party component Guzzle vulnerability ownCloud 9.0.4, 8.2.7, 8.1.9, 8.0.14 released | ownCloud.org

A third party component called “Guzzle” is affected by HTTPoxy vulnerability (as filed as CVE-2016-5385 for PHP). This component, which handles http requests on behalf of ownCloud can be tricked into passing inbound requests to a proxy server controlled by a third party. in combination with the ajax cron feature, the third party can potentially see external storage credentials and data. We recommend to use system cron whenever possible, which also significantly improves reliability and experience.
Click to expand...

eva2000 · Jul 20, 2016

Nice info & discussion on whether HTTPS/SSL mitigates HTTPoxy httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header? - Information Security Stack Exchange

First, how does this vulnerability work? This is a short form of the PHP example explained under"How it works":

The attacker sends a request with the Proxy header set to an evil IP controlled by the attacker.

If the server runs CGI, the values of all headers end up in getenv("HTTP_NAME_OF_HEADER"), or in this case getenv("HTTP_PROXY").

If the script running on the server also uses an HTTP client (like Guzzle) to send requests of its own, it might also read getenv("HTTP_PROXY"), but not to get the header but to know if it should use a proxy for the outgoing traffic. The IP sent by the attacker will then be used as a proxy.

The attacker can now MITM all the outgoing requests the server makes.

The important thing to note is that there are two requests being made here:

A. One in step #1, where the attacker makes a request to the vulnerable server.

B. One in step #3, where the vulnerable server acts as a client and makes a request somewhere else.

If you use HTTPS for A it does not matter (I guess that is what "sites served via TLS" would mean). It gets encrypted to plain old HTTP anyway. So you are vulnerable.

However, if you use HTTPS for B it can matter, since (as hectorct pointed out in comments) the attacker will not be able to MITM the request anyway, assuming the client checks the certificate and the TLS is good and so on. It is that second request that they are talking about in these passages (my highlight):

A few things are necessary to be vulnerable:

Code running under a CGI-like context, where HTTP_PROXY becomes a real or emulated environment variable

An HTTP client that trusts HTTP_PROXY, and configures it as the proxy

That client, used within a request handler, making an HTTP (as opposed to HTTPS) request

And, of course, another defense-in-depth strategy that works is to use HTTPS for internal requests, not just for securing your site’s connections to the outside world. Those aren’t affected by HTTP_PROXY.
Click to expand...

Revenge · Jul 20, 2016

As i understand, if we enable internal encryption, this problem would never happened, even without the mitigation?

eva2000 · Jul 20, 2016

Revenge said: ↑

As i understand, if we enable internal encryption, this problem would never happened, even without the mitigation?
Click to expand...

yeah i believe so for part of the request but that would mean fastcgi_pass or proxy_pass via https instead of 127.0.0.1PORT

Revenge · Jul 20, 2016

eva2000 said: ↑

yeah i believe so for part of the request but that would mean fastcgi_pass or proxy_pass via https instead of 127.0.0.1PORT
Click to expand...

And probably that would slowdown the webserver.

eva2000 · Jul 21, 2016

Revenge said: ↑

And probably that would slowdown the webserver.
Click to expand...

yeah it would

FYI, for folks holding off updating Centmin Mod code due to customised changes in their install/setup, read Upgrade - How to upgrade Centmin Mod + backing up customisations | Centmin Mod Community

Xon · Jul 21, 2016

Fyi, XenForo in it's default configuration shouldn't be vulnerable. Who knows about add-ons

Log in / Register

Forums

Welcome to Centmin Mod Community

PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 Administrator Staff Member

Updating to fix HTTPoxy

Checking if PHP-FPM is secure

Update PHP Too

eva2000 Administrator Staff Member

negative Active Member

Revenge Active Member

Revenge Active Member

Revenge Active Member

negative Active Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Xon Active Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 Administrator Staff Member

Updating to fix HTTPoxy

Checking if PHP-FPM is secure

Update PHP Too

eva2000 Administrator Staff Member

negative Active Member

Revenge Active Member

Revenge Active Member

Revenge Active Member

negative Active Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Xon Active Member

.