^{CVE-2016-1000109:}HHVM "httpoxy" vulnerability allows attackers to redirect HTTP traffic via crafted Proxy headers.

Overview

The "httpoxy" vulnerability (CVE-2016-1000109) in HHVM is a serious security issue affecting CGI applications. The vulnerability stems from HHVM's improper handling of the Proxy HTTP header, which gets converted to the HTTP_PROXY environment variable. Many HTTP client libraries use the HTTP_PROXY environment variable to determine which proxy server to use for outbound connections. By sending a malicious Proxy header in an HTTP request, an attacker can control where the application's HTTP requests are sent, potentially intercepting sensitive data or performing man-in-the-middle attacks.

This vulnerability impacts multiple versions of HHVM:

• All versions prior to 3.9.6
• All versions from 3.10.0 through 3.12.4
• All versions from 3.13.0 through 3.14.2

Remediation

To address this vulnerability, system administrators and developers should:

1. Update HHVM to a patched version:

   • Version 3.9.6 or later
   • Version 3.12.5 or later
   • Version 3.14.3 or later

2. If updating is not immediately possible, implement one of these mitigations:

   • Configure your web server to strip or block the Proxy header from incoming requests
   • For Apache, add: RequestHeader unset Proxy early
   • For Nginx, add: fastcgi_param HTTP_PROXY "";
   • For other servers, consult the httpoxy.org website for specific instructions

3. Review your application code to ensure it doesn't rely on the HTTP_PROXY environment variable in an unsafe manner

4. Consider implementing additional network-level protections such as Web Application Firewalls configured to block requests containing Proxy headers

References

1. Official patch: https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25
2. Comprehensive information about httpoxy: https://httpoxy.org/
3. Facebook security advisory: https://www.facebook.com/security/advisories/cve-2016-1000109
4. RFC 3875 section 4.1.18 (CGI specification): https://tools.ietf.org/html/rfc3875#section-4.1.18