Re: A CGI application vulnerability for PHP, Go, Python and others

[Jan Schaumann <jschauma () netmeister org>]

Richard Rowe <arch.richard () gmail com> wrote:
 
> The consequence is that an attacker can force a proxy of their choice to be
> used. This proxy receives the full request for anything sent over HTTP
> using a vulnerable client. It can also act in a malicious way to tie up
> server resources (a "reverse slowloris").

I know you mentioned it on https://httpoxy.org/, but I think it's worth
stressing explicitly again:  use of HTTPS for all requests made by the
application, internal as well as external, defeats this vulnerability
(provided certificates are actually verified).

-Jan