CVE-2016-5388

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.70 Apache Tomcat versions 8.0.0 through 8.5.4

Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This is due to the CGI Servlet following RFC 3875 section 4.1.18 and not protecting applications from the presence of untrusted client data in the HTTP PROXY environment variable.

Recommendations For Apache Tomcat versions 7.0.0 through 7.0.70, consider disabling the CGI Servlet until a mitigation is available. For Apache Tomcat versions 8.0.0 through 8.5.4, consider disabling the CGI Servlet until a mitigation is available. As a temporary workaround, restrict access to the HTTP PROXY environment variable to minimize the risk of exploitation.