CVE-2016-1000111

Overview

Twisted, an event-driven networking engine for Python, is vulnerable to an httpoxy attack (CVE-2016-1000111) in versions prior to 16.3.1. The software does not address RFC 3875 section 4.1.18 namespace conflicts, failing to protect CGI applications from untrusted client data in the HTTP_PROXY environment variable [1]. This allows an attacker to inject a malicious Proxy header into an HTTP request, which then becomes the HTTP_PROXY variable for CGI processes.

Attack

Vector

An attacker can exploit this vulnerability by sending a crafted HTTP request containing a Proxy header to a web server that uses Twisted's CGI implementation. The server naively passes the header value to the CGI subprocess as the HTTP_PROXY environment variable, without verifying the source of the data [1]. This attack requires no authentication and can be performed remotely over a network connection; the only prerequisite is that the CGI application makes outbound HTTP connections using the HTTP_PROXY variable.

Impact

If a CGI application uses HTTP_PROXY to route its outbound HTTP traffic (a common pattern), the attacker can redirect that traffic to an arbitrary proxy server under their control. This can lead to man-in-the-middle attacks, interception of sensitive data, or tampering with outbound requests from the application [1][2]. The vulnerability is part of a class of httpoxy issues that affected multiple languages and frameworks, including PHP, Go, Apache HTTPD, and others [2].

Mitigation

Twisted 16.3.1, released on August 15, 2016, fixes this vulnerability by properly sanitizing the Proxy header before CGI environment setup [4]. Users should upgrade to at least version 16.3.1 or later. The fix is included alongside other security improvements, such as fixing predictable session identifiers and insecure cookie handling [4].