You may have heard about this already. Even so, please read this post. Normally we email all possibly impacted developers directly. In this case, trying to generate a list gave me over 6 gigs of results. I trimmed it down, but given the volume of people using Guzzle and possibly using suspect code, it was more straightforward to post an alert.
httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict:
- RFC 3875 (CGI) puts the HTTP Proxy header from a request into the environment variables as HTTP_PROXY
- HTTP_PROXY is a popular environment variable used to configure an outgoing proxy
This leads to a remotely exploitable vulnerability.
You can read about the entire situation on httpoxy.org. While the fix is, as most are, a server one, all developers should be aware of this.
Don’t bother doing the following:
- Using
unset($_SERVER['HTTP_PROXY'])– it does not affect the value returned fromgetenv(), so is not an effective mitigation - Using
putenv('HTTP_PROXY=')– it does not work either (to be precise: it only works if that value is coming from an actual environment variable rather than a header – so, it cannot be used for mitigation)
You can prevent and mitigate some of this in your code. Read up on httpoxy Prevention.