CVE-2016-5387 Server-side request forgery in n/a
Remote attackers can redirect outbound HTTP traffic to arbitrary proxies via crafted headers, potentially exposing internal data or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5387?
CVE-2016-5387 is a high-severity server-side request forgery vulnerability in Apache Http Server, published on 19 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
Which versions are affected by CVE-2016-5387?
It affects 20 products.
Linux distribution packages (40)
httpd Red Hat:enterprise_linux:5::client | All versions | 0:2.2.3-92.el5_11 |
httpd-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:2.2.3-92.el5_11 |
mod_ssl Red Hat:enterprise_linux:5::client | All versions | 1:2.2.3-92.el5_11 |
httpd Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.2.3-92.el5_11 |
httpd-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.2.3-92.el5_11 |
httpd-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.2.3-92.el5_11 |
httpd-manual Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.2.3-92.el5_11 |
httpd Red Hat:enterprise_linux:5::server | All versions | 0:2.2.3-92.el5_11 |
httpd-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.2.3-92.el5_11 |
httpd-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.2.3-92.el5_11 |
httpd-manual Red Hat:enterprise_linux:5::server | All versions | 0:2.2.3-92.el5_11 |
mod_ssl Red Hat:enterprise_linux:5::server | All versions | 1:2.2.3-92.el5_11 |
httpd Red Hat:enterprise_linux:6::client | All versions | 0:2.2.15-54.el6_8 |
httpd-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.2.15-54.el6_8 |
httpd-devel Red Hat:enterprise_linux:6::client | All versions | 0:2.2.15-54.el6_8 |
httpd-manual Red Hat:enterprise_linux:6::client | All versions | 0:2.2.15-54.el6_8 |
httpd-tools Red Hat:enterprise_linux:6::client | All versions | 0:2.2.15-54.el6_8 |
mod_ssl Red Hat:enterprise_linux:6::client | All versions | 1:2.2.15-54.el6_8 |
httpd Red Hat:enterprise_linux:6::computenode | All versions | 0:2.2.15-54.el6_8 |
httpd-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.2.15-54.el6_8 |
httpd-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:2.2.15-54.el6_8 |
httpd-manual Red Hat:enterprise_linux:6::computenode | All versions | 0:2.2.15-54.el6_8 |
httpd-tools Red Hat:enterprise_linux:6::computenode | All versions | 0:2.2.15-54.el6_8 |
mod_ssl Red Hat:enterprise_linux:6::computenode | All versions | 1:2.2.15-54.el6_8 |
httpd Red Hat:enterprise_linux:6::server | All versions | 0:2.2.15-54.el6_8 |
httpd-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:2.2.15-54.el6_8 |
httpd-devel Red Hat:enterprise_linux:6::server | All versions | 0:2.2.15-54.el6_8 |
httpd-manual Red Hat:enterprise_linux:6::server | All versions | 0:2.2.15-54.el6_8 |
httpd-tools Red Hat:enterprise_linux:6::server | All versions | 0:2.2.15-54.el6_8 |
mod_ssl Red Hat:enterprise_linux:6::server | All versions | 1:2.2.15-54.el6_8 |
httpd Red Hat:enterprise_linux:6::workstation | All versions | 0:2.2.15-54.el6_8 |
httpd-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:2.2.15-54.el6_8 |
httpd-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:2.2.15-54.el6_8 |
httpd-manual Red Hat:enterprise_linux:6::workstation | All versions | 0:2.2.15-54.el6_8 |
httpd-tools Red Hat:enterprise_linux:6::workstation | All versions | 0:2.2.15-54.el6_8 |
mod_ssl Red Hat:enterprise_linux:6::workstation | All versions | 1:2.2.15-54.el6_8 |
httpd Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-40.el7_2.4 |
httpd-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-40.el7_2.4 |
httpd-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-40.el7_2.4 |
httpd-manual Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-40.el7_2.4 |
Products include Apache Http Server, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Hp System Management Homepage, Opensuse Leap and 14 more.
How do I fix CVE-2016-5387?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2016-5387 being exploited?
There is no known exploitation of CVE-2016-5387 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2016-5387, CVE-2016-1000102, DEBIAN-CVE-2016-5387, DLA-553-1, DSA-3623-1, GHSA-9hqr-6p2v-pfp2 and 10 more.