PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 · Jul 21, 2016

Xon said: ↑

Fyi, XenForo in it's default configuration shouldn't be vulnerable. Who knows about add-ons
Click to expand...

Would be at server level for php-fpm that's most relevant though ?

arlon · Jul 22, 2016

how to check that my server has been patched?

eva2000 · Jul 22, 2016

If you updated to PHP 5.5.38, 5.6.24 or 7.0.9 it also has native HTTPoxy fix via centmin.sh menu option 5 update.

or
Revenge said: ↑
Quick way to check if your site is vulnerably or not:
Create a php file with this:

PHP:

<?php if (isset($_SERVER['HTTP_PROXY']) && $_SERVER['HTTP_PROXY'] == 'vulnerable') { echo 'Vulnerable!'; }

Now run this on your server:
Code (Text):
curl --header "Proxy: vulnerable" http://example.com/httpoxy.php
If you don't receive nothing, your are good. If you receive "Vulnerable!", you are not good.
Click to expand...

eva2000 · Jul 23, 2016

Note PHP has also been updated with native HTTPoxy fixes in

PHP 5.5.38 PHP - PHP 5.5.38 is released | Centmin Mod Community

PHP 5.6.24 PHP - PHP 5.6.24 is available | Centmin Mod Community

PHP 7.0.9 PHP - PHP 7.0.9 is available | Centmin Mod Community

centmin.sh menu option 5 can be used to update your PHP versions by specifying the version number you want when prompted i.e. = 5.6.24

For folks curious of specific HTTPoxy fix commits Fix for HTTP_PROXY issue. · php/php-src@98b9dfa · GitHub

Fix for HTTP_PROXY issue.

The following changes are made:
- _SERVER/_ENV only has HTTP_PROXY if the local environment has it,
and only one from the environment.
- getenv('HTTP_PROXY') only returns one from the local environment
- getenv has optional second parameter, telling it to only consider
local environment
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 Administrator Staff Member

arlon Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

PHP Discuss HTTPoxy Security Vulnerability CVE-2016-5385

eva2000 Administrator Staff Member

arlon Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.