PT-2016-6400 · Google+4 · Go+4
Dominic Scheirlinck
+1
·
Published
2016-07-18
·
Updated
2024-06-15
·
CVE-2016-5386
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions through 1.6
Description
The issue allows remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This is due to the failure to address RFC 3875 section 4.1.18 namespace conflicts, which does not protect CGI applications from the presence of untrusted client data in the HTTP PROXY environment variable. An input validation flaw in the CGI components enables the HTTP PROXY environment variable to be set by the incoming Proxy header, changing where Go by default proxies all outbound HTTP requests.
Recommendations
For Go versions through 1.6, as a temporary workaround, consider restricting the use of the HTTP PROXY environment variable to minimize the risk of exploitation. Avoid using the
HTTP PROXY variable in the affected CGI applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Go
Huawei Vrp
Red Hat