lighttpd Information for VU#797896

• Vendor Information Help Date Notified:
• Statement Date: 19 Jul 2016
• Date Updated: 19 Jul 2016

Status

Affected

Vendor Statement

Mitigation of httpoxy is available in lighttpd.


Mitigation:

lighttpd <= 1.4.40 (reject requests containing "Proxy" header)

* Create "/path/to/deny-proxy.lua", read-only to lighttpd, with content:
if (lighty.request["Proxy"] == nil) then return 0 else return 403 end

* Modify lighttpd.conf to load mod_magnet and run lua code
server.modules += ( "mod_magnet" )
magnet.attract-raw-url-to = ( "/path/to/deny-proxy.lua" )

lighttpd2 (development) (strip "Proxy" header from request)
* Add to lighttpd.conf: req_header.remove "Proxy";


Reference:

* lighttpd 1.4 repo contains fix on git master branch to strip "Proxy" header and the commit message below contains the above mitigation steps for lighttpd 1.4.x https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/779c133c16f9af168b004dce7a2a64f16c1cb3a4


Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/779c133c16f9af168b004dce7a2a64f16c1cb3a4

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.