PT-2020-7930 · Facebook · Hhvm

Published 2020-02-19 · Updated 2020-03-06 · CVE-2016-1000109

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 3.9.6 HHVM versions 3.10.0 through 3.12.4 HHVM versions 3.13.0 through 3.14.2

Description: The issue allows remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, due to the presence of untrusted client data in the HTTP PROXY environment variable. This is related to not addressing RFC 3875 section 4.1.18 namespace conflicts.

Recommendations: For versions prior to 3.9.6, update to version 3.9.6 or later. For versions 3.10.0 through 3.12.4, update to a version outside of this range. For versions 3.13.0 through 3.14.2, update to a version outside of this range. As a temporary workaround, consider restricting access to the HTTP PROXY environment variable to minimize the risk of exploitation.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2016-1000109

Affected Products

Hhvm

References · 9

• 🔥 https://httpoxy.org · Exploit
• https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000109 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-1000109 · Security Note
• https://ubuntu.com/security/CVE-2016-1000109 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1000109 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000109 · Vendor Advisory
• https://kb.cert.org/vuls/id/JLAD-ABYJS2 · Note
• https://facebook.com/security/advisories/cve-2016-1000109 · Note