CVE-2016-5385

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.9

Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This can be achieved by exploiting the presence of untrusted client data in the HTTP PROXY environment variable, which the application does not protect against. The issue affects applications that make a getenv('HTTP PROXY') call or have a CGI configuration of PHP.

Recommendations For PHP versions prior to 7.0.9, update to version 7.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP PROXY environment variable to minimize the risk of exploitation. Avoid using the getenv('HTTP PROXY') call in applications until the issue is resolved.