10107—Httpoxy - Proxy Header Misuse

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 10107
Risk:: High
Type:: Active
CWE:: CWE-20Improper Input Validation

摘要

The server initiated a proxied request via the proxy specified in the HTTP Proxy header of the request.Httpoxy typically affects code running in CGI or CGI like environments.

This may allow attackers to:

解决方案

The best immediate mitigation is to block Proxy request headers as early as possible, and before they hit your application.

其他信息

An outgoing message to http://192.168.0.11:1080/ was proxied via the host and port that ZAP injected into the HTTP Proxy header.

参考

browse all alerts