Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict HTTP_PROXY access control
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
7.9 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, has been found in Apache HTTP Server up to 2.4.23 (Web Server). This issue affects some unknown processing of the component RFC 3875 Namespace Conflict Handler. The manipulation of the argument HTTP_PROXY
as part of a Environment Variable leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
The weakness was shared 07/19/2016 as Apache Software Foundation Projects and "httpoxy" CERT VU#797896 as confirmed advisory (Website). The advisory is shared at apache.org. The identification of this vulnerability is CVE-2016-5387 since 06/10/2016. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.
The vulnerability scanner Nessus provides a plugin with the ID 93118 (RHEL 7 : JBoss Web Server (RHSA-2016:1648) (httpoxy)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370348 (Apple Mac OS X Security Update Sierra 10.12.4, El Capitan 2017-001 and Yosemite 2017-001 Not Installed (APPLE-SA-2017-03-27-3)).
Applying a patch is able to eliminate this problem. It is possible to mitigate the problem by applying the configuration setting RequestHeader unset Proxy early
. The best possible mitigation is suggested to be patching the affected component. A possible mitigation has been published 2 months after the disclosure of the vulnerability. Attack attempts may be identified with Snort ID 39737.
The vulnerability is also documented in the vulnerability database at Tenable (93118). nginx.com is providing further details.
Product
Type
Vendor
Name
Version
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.4.5
- 2.4.6
- 2.4.7
- 2.4.8
- 2.4.9
- 2.4.10
- 2.4.11
- 2.4.12
- 2.4.13
- 2.4.14
- 2.4.15
- 2.4.16
- 2.4.17
- 2.4.18
- 2.4.19
- 2.4.20
- 2.4.21
- 2.4.22
- 2.4.23
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.1VulDB Meta Temp Score: 7.9
VulDB Base Score: 8.1
VulDB Temp Score: 7.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 8.1
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-284 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 93118
Nessus Name: RHEL 7 : JBoss Web Server (RHSA-2016:1648) (httpoxy)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 14611
OpenVAS Name: Amazon Linux Local Check: alas-2016-725
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
Exposure Time: 🔍
Config: RequestHeader unset Proxy early
Snort ID: 39737
Snort Message: SERVER-WEBAPP HttpOxy CGI application vulnerability potential man-in-the-middle attempt
Snort Class: 🔍
Timeline
06/10/2016 🔍07/18/2016 🔍
07/18/2016 🔍
07/19/2016 🔍
07/19/2016 🔍
08/22/2016 🔍
08/26/2016 🔍
09/05/2022 🔍
Sources
Vendor: apache.orgAdvisory: Apache Software Foundation Projects and "httpoxy" CERT VU#797896
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2016-5387 (🔍)
OVAL: 🔍
CERT VU: 🔍
SecurityTracker: 1036330
SecurityFocus: 91816 - Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
Misc.: 🔍
Entry
Created: 07/19/2016 10:07Updated: 09/05/2022 10:46
Changes: 07/19/2016 10:07 (64), 03/02/2019 15:56 (27), 09/05/2022 10:46 (3)
Complete: 🔍
Cache ID: 18:3ED:103
No comments yet. Languages: en.
Please log in to comment.