CVE-2016-5385 Server-side request forgery in n/a
Remote attackers can redirect outbound HTTP traffic to arbitrary proxies via crafted headers, potentially exposing internal data or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5385?
CVE-2016-5385 is a high-severity server-side request forgery vulnerability in Debian Debian Linux, published on 19 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Weakness: CWE-601
Which versions are affected by CVE-2016-5385?
8 open source packages ship an affected version, including guzzlehttp/guzzle, amphp/artax and bugsnag/bugsnag-laravel. It affects 13 products.
| Package | Affected | Fixed in |
|---|---|---|
guzzlehttp/guzzle Packagist | From 4.0.0-rc2 | 4.2.4 |
guzzlehttp/guzzle Packagist | From 5 | 5.3.1 |
guzzlehttp/guzzle Packagist | From 6 | 6.2.1 |
amphp/artax Packagist | All versions | 1.0.4 |
amphp/artax Packagist | From 2.0.0 | 2.0.4 |
bugsnag/bugsnag-laravel Packagist | All versions | 2.0.2 |
2 more packages
drupal/core Packagist | From 8.0 | 8.1.7 |
padraic/humbug_get_contents Packagist | All versions | 1.1.2 |
Linux distribution packages (32)
php Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-bcmath Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-cli Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-common Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-dba Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-devel Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-embedded Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-enchant Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-fpm Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-gd Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-imap Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-intl Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-ldap Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-mbstring Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-mysql Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-odbc Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-pdo Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-pgsql Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-process Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-pspell Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-recode Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-snmp Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-soap Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-tidy Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-xml Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-xmlrpc Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php-zts Red Hat:enterprise_linux:6::client | All versions | 0:5.3.3-48.el6_8 |
php Red Hat:enterprise_linux:6::computenode | All versions | 0:5.3.3-48.el6_8 |
php-bcmath Red Hat:enterprise_linux:6::computenode | All versions | 0:5.3.3-48.el6_8 |
php-cli Red Hat:enterprise_linux:6::computenode | All versions | 0:5.3.3-48.el6_8 |
php-common Red Hat:enterprise_linux:6::computenode | All versions | 0:5.3.3-48.el6_8 |
Products include Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Hp Storeever Msl6480 Tape Library Firmware, Hp System Management Homepage, Opensuse Leap and 7 more.
How do I fix CVE-2016-5385?
Upgrade guzzlehttp/guzzle to a fixed version for your release line: 4.2.4, 5.3.1 or 6.2.1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2016-5385 being exploited?
There is no known exploitation of CVE-2016-5385 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CVE-2016-1000100, GHSA-m6ch-gg5f-wxx3, RHSA-2016:1609, RHSA-2016:1610, RHSA-2016:1611, RHSA-2016:1612 and 3 more.