Full protection from httpoxy CGI vulnerability on all servers

One of the main causes for discomfort among Internet users lately is a recently re-discovered server-side application vulnerability – httpoxy.

It affects applications whose code is executed in CGI or other CGI-like environments.

One of the measures taken in order to address this vulnerability was to enable automatic website and app protection for managed solutions on the web hosting platform.

How does the ‘httpoxy’ vulnerability work?

The reason why the ‘httpoxy’ vulnerability presents such a threat is the fact that it provides ‘a green corridor’ for individuals with malicious intentions – thus allowing them to exploit the communication between a web application and other external applications via API.

Some of the unwanted consequences of a vulnerable web application making an outgoing HTTP connection are:

• the outgoing HTTP requests could be proxied
• the server can be configured to send private information to a particular address and port
• it forces the application to use a malicious proxy
• it exhausts the server resources

In case a hacker makes a request that includes a ‘Proxy’ request header – an outgoing connection can be exploited.

The aforementioned header is subsequently turned by the CGI into an environment variable called HTTP_PROXY. In turn it configures an outgoing proxy.

Afterwards, the web application makes a request to a destination selected by the hacker rather than to the particular API.

Protection measures against ‘httpoxy’ (Managed Services):

We patched all of the web hosting services that are under our control the instant we were informed about the ‘httpoxy’ vulnerability.

Among these web hosting services are:
• All web hosting services
• All semi-dedicated servers
• Hepsia Control Panel-managed OpenVZ Virtual Private Servers
• Managed OpenVZ Virtual Private Servers
• Hepsia Control Panel-managed dedicated servers
• Managed dedicated servers

Protection measures against ‘httpoxy’ (Unmanaged Services):

You will have to take immediate measures to protect your applications from the ‘httpoxy’ vulnerability – provided you are using a non-managed OpenVZ server, a KVM VPS or a dedicated server, or/and do not use the Hepsia Control Panel.

In the following cases your applications are immune to the ‘httpoxy’ vulnerability:

• since ‘httpoxy’ only affects unencrypted requests, your applications would be totally safe if they are making API requests over an encrypted (SSL/TLS/HTTPS) connection
• if you use one of the many faster and better code environment alternatives of CGI that were introduced over the last few years

Another solution that would keep you safe in case you are using CGI with no encrypted connection is to block the ‘Proxy’ header.