Weblog

There is some fuzz going on about httpoxy. According to the httpoxy website, it's a 'set of vulnerabilities that affect application code running in CGI, or CGI-like environments'. If you ask me, it's just another blindly-trusting-user-input stupidity.

So, what's going on? It's all about a non-official HTTP header named 'Proxy'. Some HTTP client applications or libraries seem to blindly trust its content and will use the proxy mentioned in it to send HTTP requests. If your server-side application uses such vulnerable client software to make a HTTP request (now called back-end request), an attacker can send a Proxy header in his own HTTP request, to make the back-end request to be send to his own server. That back-end request may contain confidential information.

How to block such request? Since it's not an official HTTP header, no sane client will send it. Simply block any such request (or ban the sending client) via the UrlToolkit:

UrlToolkit {
  ToolkitID = block_httpoxy
  Header Proxy .* DenyAccess
}