CVE-2016-1000111 – Twisted: sets environmental variable based on user supplied Proxy request header

https://notcve.org/view.php?id=CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Twisted versiones anteriores a la versión 16.3.1, no intenta abordar los conflictos de espacio de nombres RFC 3875 sección 4.1.18 y, por lo tanto, no protege las aplicaciones CGI de la presencia de datos de clientes no seguros en la variable de entorno HTTP_PROXY, lo que podría permitir a atacantes remotos redireccionar un tráfico HTTP saliente de una aplicación CGI hacia un servidor proxy arbitrario por medio de un encabezado Proxy especialmente diseñado en una petición HTTP, también se conoce como un problema "httpoxy". It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. • http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html https://twistedmatrix.com/trac/ticket/8623 https://www.openwall.com/lists/oss-security/2016/07/18/6 https://access.redhat.com/security/cve/CVE-2016-1000111 https://bugzilla.redhat.com/show_bug.cgi?id=1357345 • CWE-20: Improper Input Validation CWE-425: Direct Request ('Forced Browsing') •