SSRF in Guzzle library in Drupal - CVE-2016-5385

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands on vulnerable system.

The vulnerability exists due to usage of third-party PHP library Guzzle for performing server-side HTTP requests. A remote attacker can use malicious server that returns a 301 HTTP redirect response to local resource to connect to services within internal network or on localhost.

Successful exploitation of this vulnerability may allow an attacker to perform SSRF attack to retrieve information for further attacks against vulnerable system by performing unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.

Note: this vulnerability is being actively exploited in the wild and is referred as HTTPoxy.

Affected software

How to mitigate CVE-2016-5385

External References

• https://www.drupal.org/SA-CORE-2016-003
• https://httpoxy.org/

Related Security Bulletins

• Server-side request forgery in Drupal 8.x
• Red Hat update for php
• Red Hat update for php
• Slackware Linux update for php
• Fedora 23 update for php-guzzlehttp-guzzle6
• Fedora 24 update for php-guzzlehttp-guzzle6
• Fedora 23 update for php-guzzlehttp-guzzle
• Fedora EPEL 7 update for php-guzzlehttp-guzzle
• Fedora 24 update for php-guzzlehttp-guzzle
• Fedora 23 update for php
• Fedora 24 update for php
• Red Hat Software Collections update for rh-php56-php
• Red Hat Software Collections update for php55-php
• Red Hat Software Collections update for php54-php