CVE-2016-5387

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.25 Apache HTTP Server versions prior to 2.2.32

Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This is due to the presence of untrusted client data in the HTTP PROXY environment variable. The problem arises from libraries overloading well-established CGI environment variables, specifically the HTTP PROXY variable.

Recommendations For Apache HTTP Server versions prior to 2.4.25, update to version 2.4.25 or later. For Apache HTTP Server versions prior to 2.2.32, update to version 2.2.32 or later. As a temporary workaround, consider avoiding the population of the HTTP PROXY variable from a "Proxy:" header in the httpd CGI environment.