CVE-2016-1000108 Server-side request forgery in n/a
Remote attackers can redirect CGI outbound traffic to arbitrary proxies via crafted HTTP headers, enabling potential data interception or SSRF attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-1000108?
CVE-2016-1000108 is a medium-severity server-side request forgery vulnerability in Debian Debian Linux, published on 10 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Weakness: CWE-601
Which versions are affected by CVE-2016-1000108?
It affects 2 products.
Products include Debian Debian Linux, Yaws Yaws.
How do I fix CVE-2016-1000108?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2016-1000108 being exploited?
There is no known exploitation of CVE-2016-1000108 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-1000108, GHSA-42gq-6jpg-qgvv, UBUNTU-CVE-2016-1000108.