Settings

Theme

Mitigating the HTTPoxy Vulnerability with Nginx

nginx.com

51 points by kgogolek 10 years ago · 9 comments

Reader

rahkiin 10 years ago

> The vulnerability was mentioned on the NGINX mailing list in July, 2013, by Jonathan Matthews.

Wow, that is long ago. Why isn't this mitigated earlier? The attack is very simple.

drdaeman 10 years ago

There are mentions of Python... Does this affect WSGI applications, in particular, uWSGI?

AFAIK, uWSGI somewhat resembles but doesn't emulate CGI (unlike how FastCGI works), and WSGI application's `environ` parameter isn't related to `os.environ`, so it should be safe. But I may be mistaken here...

  • adrianratnapala 10 years ago

    I don't know about uWSGI, but here is what it says at httproxy.org

    ----

    Python code must be deployed under CGI to be vulnerable. Usually, that’ll mean the vulnerable code will use a CGI handler like wsgiref.handlers.CGIHandler

    This is not considered a normal way of deploying Python webapps (most people are using WSGI or FastCGI, both of which are not affected),

    • cleeus 10 years ago

      btw, the reference FastCGI C library libfcgi also alters the environment to emulate legacy CGI and may also be vulnerable (haven't checked).

jimjag 10 years ago

NGINX should have really applied for a CVE instead of pretending that they are immune.

  • FooBarWidget 10 years ago

    But Nginx isn't vulnerable. All Nginx does is proxying the HTTP headers. It is the applications that run behind Nginx that may be vulnerable depending on how they set/use environment variables.

    Saying Nginx is vulnerable is like saying that the Linux kernel is vulnerable to heartbleed.

    • cleeus 10 years ago

      I think the CGI "standard" is to be blamed.

      Whoever the f*ck had the briliant idea to alter the environment variables of a server child process through incoming HTTP headers should have his browsers environment variables altered by the servers responses.

    • jimjag 10 years ago

      It's as much to blame by not, within the actual code, refusing to clear PROXY... Apache httpd isn't "vulnerable" either but it still created a code patch that ensures things don't sneak thru as WELL as proving a runtime workaround. Plus, even the nginx mailing list example shows that it's a security issue.

Keyboard Shortcuts

j
Next item
k
Previous item
o / Enter
Open selected item
?
Show this help
Esc
Close modal / clear selection