Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Twisted Web HTTP Server Direct Request (Forced Browsing) Vulnerability - CVE-2016-1000111 - Vulnerability Database
Twisted Web HTTP Server

Twisted Web HTTP Server Direct Request (Forced Browsing) Vulnerability - CVE-2016-1000111

Medium
Reference: CVE-2016-1000111
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-1000111
Title: Twisted Web HTTP Server Direct Request (Forced Browsing) Vulnerability
Overview:

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable which might allow remote attackers to redirect a CGI application39s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request aka an quothttpoxyquot issue.