Executive brief
Twisted, a popular Python framework for building networked applications, fails to sanitize the HTTP_PROXY environment variable when processing CGI requests. An attacker can exploit this by sending a crafted Proxy header in an HTTP request, causing the application's outbound HTTP traffic to be redirected through an attacker-controlled proxy server. This allows interception or manipulation of outbound communications.
Technical details
The vulnerability stems from Twisted's failure to address RFC 3875 section 4.1.18 namespace conflicts. When handling CGI requests, Twisted does not sanitize untrusted client data in the HTTP_PROXY environment variable, enabling the "httpoxy" attack vector. An unauthenticated remote attacker can send a crafted Proxy header in an HTTP request to redirect the CGI application's outbound HTTP traffic to an arbitrary proxy server. The attack requires no authentication or user interaction and is network-reachable. A fix is available in Twisted 16.3.1 and later.
Affected products
- Twisted Twisted before 16.3.1
Timeline
- 2021-04-30: disclosed
- 2016-03-24: patched: Fix released in version 16.3.1